# PhishDestroy domain threat record: best-htx.com.cn

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/best-htx.com.cn/
Machine-readable companion: https://phishdestroy.io/domain/best-htx.com.cn/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 12:56:53 UTC
- Last availability or vendor check: 2026-10-23 12:56:53 UTC
- Stored record updated: 2026-10-23 16:30:27 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: HTX

## Stored infrastructure

- Observed IP address: 172.67.163.127
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a168d4-ad72-72e8-83a1-7371e1ddb833/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/best-htx.com.cn
- Certificate Transparency search: https://crt.sh/?q=%25.best-htx.com.cn
- Web Archive lookup: https://web.archive.org/web/*/https://best-htx.com.cn/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake AI classified the site as malicious because it impersonates the HTX (Huobi) exchange, using the brand name, logo and a disclaimer that it is an independent third‑party page. The recorded page title reads “火币 - htx - 火币交易所” and the meta description promote the exchange and an Android app download. PhishDestroy first observed the domain on 2026-10-23 and recorded an HTTP 200 response on that date.

How the scam works
In brand‑impersonation phishing, attackers create pages that copy the visual identity and wording of a legitimate cryptocurrency exchange to lure users into entering login credentials or downloading malicious software. Victims who submit credentials may have their accounts compromised, and downloaded apps can harvest private keys or install malware.

Evidence
VirusTotal scanned the domain on 2026-10-23 and reported 0 detections out of 92 engines. Google Safe Browsing returned no flag on the same date. OTX listed three pulses referencing the domain as of 2026-10-23. URLScan’s machine‑learning engine marked the site malicious with a score of 81, while its overall verdict was non‑malicious; Cloudflare Radar identified the page as phishing. PhishDestroy’s internal blocklist includes the domain, flagged on 2026-10-23.

Infrastructure
The domain was observed pointing to Cloudflare IP addresses 172.67.163.127 and 104.21.49.135, both belonging to Cloudflare, Inc. The TLS certificate was issued by Let’s Encrypt (YE1) and was valid from 2026-10-22 to 2027-01-20. DNS records showed Cloudflare name servers and the domain age was recorded as zero days at the time of observation.

What to do
Users should avoid entering any HTX credentials or downloading the advertised Android app from this site; if credentials were entered, change the password on the official HTX platform and enable two‑factor authentication. Organizations should block best-htx.com.cn at the network perimeter and monitor for connections to its recorded IP addresses. Security teams can reference the PhishDestroy internal blocklist entry for further investigation.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a168d4-ad72-72e8-83a1-7371e1ddb833/
Cloudflare Radar report: https://radar.cloudflare.com/scan/4277c8c9-f6ee-4bd0-b0cf-b1014296a45d
URLQuery report: https://urlquery.net/report/f499a93f-879b-4157-9e6d-3d653a092572
Stored capture screenshot: https://i.ibb.co/V0fg6pFM/36649eaf7572.png
Cloudflare Radar screenshot (2026-10-23T13:31:44Z): https://screenshots.phishdestroy.io/cf/4277c8c9-f6ee-4bd0-b0cf-b1014296a45d.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/f499a93f-879b-4157-9e6d-3d653a092572.png
URLScan screenshot (2026-10-23T13:01:39Z): https://screenshots.phishdestroy.io/us/01a168da-3385-766d-8b5b-e699d625330d.png
URLScan capture report: https://urlscan.io/result/01a168da-3385-766d-8b5b-e699d625330d/
VirusTotal report: https://www.virustotal.com/gui/domain/best-htx.com.cn
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=best-htx.com.cn
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-23 13:34:39 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/V0fg6pFM/36649eaf7572.png
  Captured: 2026-10-23 12:56:53 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a168d4-ad72-72e8-83a1-7371e1ddb833.png
  Captured: 2026-10-23 12:56:53 UTC
  Source report: https://urlscan.io/result/01a168d4-ad72-72e8-83a1-7371e1ddb833/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/4277c8c9-f6ee-4bd0-b0cf-b1014296a45d.png
  Captured: 2026-10-23 13:31:44 UTC
  Source report: https://radar.cloudflare.com/scan/4277c8c9-f6ee-4bd0-b0cf-b1014296a45d
  SHA-256: b95357bd20f2b74d1b000a0095946e54bda73b18b51add0b61385e0dd9bfb28b
- URLQuery: https://screenshots.phishdestroy.io/uq/f499a93f-879b-4157-9e6d-3d653a092572.png
  Source report: https://urlquery.net/report/f499a93f-879b-4157-9e6d-3d653a092572
  SHA-256: 97b4df202823365ac0a5a699d89afed0bc1ab20198b21dbb7132ee9799931f8f
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a168da-3385-766d-8b5b-e699d625330d.png
  Captured: 2026-10-23 13:01:39 UTC
  Source report: https://urlscan.io/result/01a168da-3385-766d-8b5b-e699d625330d/
  SHA-256: e3a3b6b376ce55dbe86b75dc019c0cf3e9418a95e5990324d728b8a8da9bfec1

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T13:33:25Z",
        "uuid": "01a168d4-ad72-72e8-83a1-7371e1ddb833",
        "scanned_at": "2026-10-23T12:55:37Z",
        "final_url": "https://best-htx.com.cn/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://best-htx.com.cn/",
                "from": "http://best-htx.com.cn/",
                "status": 307
            }
        ],
        "ip": "104.21.49.135",
        "ips": [
            "104.21.49.135"
        ],
        "asns": [
            "13335"
        ],
        "link_domains": [
            "www.best-htx.com.cn"
        ],
        "doc_hash": "1b1dddabc691a960442a6fe3fcddbfaece0d089b0385a70115f0524560cf4eff",
        "cookies": [
            "server_session_7d25baa6"
        ],
        "tls": {
            "san": [
                "*.best-htx.com.cn",
                "best-htx.com.cn"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "best-htx.com.cn",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-20T09:35:20Z",
            "valid_from": "2026-10-22T09:35:21Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 81,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T13:33:29Z",
        "uuid": "4277c8c9-f6ee-4bd0-b0cf-b1014296a45d",
        "scanned_at": "2026-10-23T13:31:44Z",
        "final_url": "https://best-htx.com.cn/",
        "status": 200,
        "history": [
            {
                "url": "https://best-htx.com.cn/",
                "status": 200
            }
        ],
        "dom_hash": "243601d1ad1639857f031106cf36650d1ef9ca308b523bcae6f0e769c51bcc67",
        "doc_hash": "2faf400f5f43bcbfd0da318770916fb0c12f21d70a20f82b911eb2ca0cabf5c4",
        "phishing_v2": [
            "phishing"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "best-htx.com.cn",
                "type": "A",
                "value": "104.21.49.135"
            },
            {
                "name": "best-htx.com.cn",
                "type": "A",
                "value": "172.67.163.127"
            },
            {
                "name": "best-htx.com.cn",
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:a37f"
            },
            {
                "name": "best-htx.com.cn",
                "type": "AAAA",
                "value": "2606:4700:3031::6815:3187"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.49.135",
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-10-22T18:25:28Z",
            "expires": "2027-10-22T18:25:28Z",
            "nameservers": [
                "emma.ns.cloudflare.com",
                "austin.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T13:31:03Z",
        "analysis_at": "2026-10-23T10:21:15Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "first_seen": "2026-10-22T10:43:03Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.163.127"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:a37f"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::6815:3187"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "emma.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "austin.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.49.135"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "austin.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-23T10:32:27Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.best-htx.com.cn",
                "best-htx.com.cn"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "66b2e43767637800dcaf0e3679c35e8c238",
            "sha256": "f1d8dbd5abf2708acf026566abfe6767db9e0c0afdc09e3e48ea2f704daac356",
            "subject": "best-htx.com.cn",
            "valid_to": "2027-01-20T09:35:20Z",
            "valid_from": "2026-10-22T09:35:21Z"
        },
        "whois": {
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "austin.ns.cloudflare.com",
                "emma.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T13:33:45Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "best-htx.com.cn"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-23T12:59:37Z",
            "first": "2026-10-23T12:59:37Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 11554
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://www.best-htx.com.cn/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 1
        },
        "social_tags": {
            "title": "火币 - htx - 火币交易所",
            "author": "火币 htx",
            "ogType": "website",
            "robots": "index,follow,max-image-preview:large",
            "ogTitle": "火币 htx 信息导航入口｜安卓 App 下载与注册开户指南",
            "keywords": "火币,htx,火币下载,火币App,安卓下载,火币注册,htx信息导航,数字资产交易,比特币交易,以太坊",
            "ogSiteName": "火币 htx",
            "themeColor": "#050708",
            "description": "火币 htx 是全球领先的数字资产交易平台，支持比特币、以太坊等数百种币种的现货、合约与理财服务。本页提供 htx 安卓 App 官方下载入口与注册开户指南，界面简洁、撮合极速、资产安全可靠。",
            "twitterCard": "summary_large_image",
            "ogDescription": "全球领先的数字资产交易平台，极速撮合、深度流动性、多重安全防护。一键下载安卓 App，即刻开始交易。"
        },
        "trackers": {
            "requests": 1
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 3,
                "tls": 18,
                "wait": 666,
                "connect": 6,
                "download": 0
            },
            "response_ms": 693
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 36477,
            "co2_grams": 0.0013,
            "cleaner_than": 44
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.32.112",
                    "host": "emma.ns.cloudflare.com"
                },
                {
                    "ip": "173.245.59.70",
                    "host": "austin.ns.cloudflare.com"
                }
            ],
            "zone": "best-htx.com.cn"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "server_session_7d25baa6",
                    "secure": true,
                    "http_only": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "2606:4700:3031::ac43:a37f",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "best-htx.com.cn"
        },
        "dns": {
            "A": [
                "104.21.49.135",
                "172.67.163.127"
            ],
            "NS": [
                "austin.ns.cloudflare.com",
                "emma.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"austin.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418174022, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3031::6815:3187",
                "2606:4700:3031::ac43:a37f"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000",
            "message": "HSTS header does not include all subdomains."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=31536000",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3031::6815:3187",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://best-htx.com.cn"
            ]
        },
        "linked_pages": {
            "external": [
                "https://www.best-htx.com.cn/index.html"
            ],
            "external_count": 1,
            "internal_count": 6
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-10-22T16:25:28Z",
            "expires": "2027-10-22T16:25:28Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "emma.ns.cloudflare.com",
                "austin.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html",
                "strict-transport-security": "max-age=31536000"
            }
        }
    }
}
```