# PhishDestroy domain threat record: htx-io.carrd.co Content language: English Canonical HTML report: https://phishdestroy.io/domain/htx-io.carrd.co/ Machine-readable companion: https://phishdestroy.io/domain/htx-io.carrd.co/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-08-28 13:19:05 UTC - Last availability or vendor check: 2026-10-22 10:09:57 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 5/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: HTX ## Stored infrastructure - Observed IP address: 104.18.40.34 - Registrar in stored WHOIS data: Carrd - Last stored HTTP status: 403 - Registration date (registry RDAP, carrd.co): 2015-04-30 03:22:48 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a04884-f23f-71fe-9031-d282926a01c8/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/htx-io.carrd.co - Certificate Transparency search: https://crt.sh/?q=%25.htx-io.carrd.co - Web Archive lookup: https://web.archive.org/web/*/https://htx-io.carrd.co/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview htx-io.carrd.co is a fake login page that impersonates HTX, the cryptocurrency exchange, and targets its account holders. It is built on Carrd, a free site builder, so the address borrows the builder's domain instead of anything owned by HTX. PhishDestroy first flagged it on 2026-08-28, and it was still online on 2026-10-19. How the scam works The page is titled "HTX — Log In®", and the stray trademark symbol is a typical touch on hastily cloned brand pages. Victims usually arrive through ads, direct messages or fake support replies and are asked to sign in. Anything typed into the form, such as an email or phone number, password and one-time 2FA codes, goes to the operators. They can then use those details on the real exchange to take over the account and withdraw its balance before the owner notices. Evidence On 2026-10-12, 5 of 92 VirusTotal engines flagged the page: alphaMountain.ai, Chong Lua Dao, Forcepoint ThreatSeeker, Fortinet and LevelBlue. That count is modest, so many browsers and security products will still load the page without a warning. Detection is stronger in the crypto-specific lists. MetaMask's phishing list and SEAL both carry the domain alongside PhishDestroy, which means wallet users and incident responders are already warned about it. Infrastructure The site is a subdomain on Carrd's platform, so there was no domain registration that could have revealed when the operation began. Traffic is served through Cloudflare, Inc., with the address geolocated to Canada. That puts the real origin behind a widely used proxy. The page uses a free, automatically issued Google Trust Services certificate. The padlock in the browser only means the connection is encrypted and says nothing about whether the site is legitimate. What to do If you typed HTX credentials into this page, go to HTX directly and change your password immediately. Reset your 2FA, end all active sessions, and check your withdrawal address whitelist and API keys for anything you did not create. If you reused that password anywhere else, change it there as well. Contact HTX support at once if you see unfamiliar logins or withdrawals. Defenders should block this subdomain, report it to Carrd and Cloudflare, and warn users that real HTX logins never run on site-builder subdomains. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a04884-f23f-71fe-9031-d282926a01c8/ VirusTotal report: https://www.virustotal.com/gui/domain/htx-io.carrd.co Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=htx-io.carrd.co Archived copy: https://web.archive.org/web/20260921181016/https://htx-io.carrd.co/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:55:10 UTC ## Stored page captures - Primary capture: https://i.ibb.co/ksbrpj40/aeb0c21ef8b7.png Captured: 2026-08-28 13:19:05 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a04884-f23f-71fe-9031-d282926a01c8.png Captured: 2026-08-28 13:19:05 UTC Source report: https://urlscan.io/result/01a04884-f23f-71fe-9031-d282926a01c8/ ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T04:29:52Z", "uuid": "01a04884-f23f-71fe-9031-d282926a01c8", "scanned_at": "2026-08-28T13:17:53Z", "final_url": "https://htx-io.carrd.co/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://htx-io.carrd.co/", "from": "http://htx-io.carrd.co/", "status": 307 } ], "ip": "172.64.147.222", "ips": [ "172.64.147.222" ], "asns": [ "13335" ], "link_domains": [ "carrd.co" ], "doc_hash": "41c6d327372a7f17d3adae3ca9f037c820d4e2a27b2a5fbd3bb98bbbf4afa5ec", "globals": [ "ontouchcancel", "ontouchend", "ontouchmove", "ontouchstart", "_scrollToTop" ], "tls": { "san": [ "carrd.co", "*.carrd.co" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "carrd.co", "protocol": "TLS 1.3", "valid_to": "2026-10-12T03:43:53Z", "valid_from": "2026-07-14T02:43:56Z" }, "domain_age_days": 12, "apex_age_days": 12, "tls_age_days": 45, "tls_valid_days": 90, "requests": 3, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 97, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html", "content-security-policy": "frame-ancestors https://carrd.com;", "x-frame-options": "deny" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:39:51Z", "uuid": "830ef421-a82a-4579-a2e4-5a7a7527f70d", "scanned_at": "2026-08-28T13:50:15Z", "final_url": "https://htx-io.carrd.co/", "status": 200, "redirected": "https-only", "history": [ { "url": "http://htx-io.carrd.co/", "status": 307 }, { "url": "https://htx-io.carrd.co/", "status": 200 } ], "dom_hash": "e0ca826a569c7a29e1fc3503c8fbefdeb8256d40bfea5c9779e6028ef6e601f2", "doc_hash": "41c6d327372a7f17d3adae3ca9f037c820d4e2a27b2a5fbd3bb98bbbf4afa5ec", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "htx-io.carrd.co", "type": "A", "value": "104.18.40.34" }, { "name": "htx-io.carrd.co", "type": "A", "value": "172.64.147.222" } ], "dnssec_valid": false, "ip": "104.18.40.34" } } ```