# PhishDestroy domain threat record: link-htx.com.cn

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/link-htx.com.cn/
Machine-readable companion: https://phishdestroy.io/domain/link-htx.com.cn/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 12:56:22 UTC
- Last availability or vendor check: 2026-10-23 12:56:22 UTC
- Stored record updated: 2026-10-23 16:30:26 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: HTX

## Stored infrastructure

- Observed IP address: 172.67.210.1
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a168d3-e723-7729-9260-376eb86fecc7/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/link-htx.com.cn
- Certificate Transparency search: https://crt.sh/?q=%25.link-htx.com.cn
- Web Archive lookup: https://web.archive.org/web/*/https://link-htx.com.cn/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake AI classified the site as malicious because it impersonates the HTX (formerly Huobi) exchange, displays a disclaimer that it is an independent third‑party information page, and provides Android app download and registration links. The recorded page title is “火币 - htx - 火币交易所中文版” and the page excerpt includes “HTX 官方下载指引” and “立即注册”. The domain was first seen by PhishDestroy on 2026-10-23 and returned an HTTP 200 response at that time.

How the scam works
Impersonation pages copy the branding and terminology of legitimate cryptocurrency exchanges to lure users into downloading software or entering login credentials that can be harvested. By claiming to be unaffiliated, the page attempts to lower suspicion while still directing victims toward potentially malicious app installers or phishing forms.

Evidence
VirusTotal scanned the domain on 2026-10-22 and reported 0 malicious detections out of 92 engines. Google Safe Browsing checked the URL on 2026-10-23 and did not flag it. OTX showed 0 pulses on the same date. urlscan.io captured the site on 2026-10-23; its machine‑learning engine assigned a malicious score of 86 and tagged the page with malicious indicators, although its overall verdict was non‑malicious. PhishDestroy’s internal blocklist includes the domain based on the intake assessment.

Infrastructure
The domain resolved to the Cloudflare IPs 172.67.210.1 and 104.21.58.237 and the DNS records listed austin.ns.cloudflare.com and emma.ns.cloudflare.com. The TLS certificate was issued by Let’s Encrypt on 2026-10-22 and is valid until 2027-01-20. The domain and its apex had an age of zero days at the time of observation, indicating a newly created registration.

What to do
Avoid downloading any application or entering credentials on this site; if HTX login details were entered, change the HTX password and enable two‑factor authentication while monitoring the account for unauthorized activity. Defenders should block the exact domain, log any DNS queries to it, and add the domain to internal threat‑intel feeds.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a168d3-e723-7729-9260-376eb86fecc7/
Cloudflare Radar report: https://radar.cloudflare.com/scan/b456171e-c6fd-4c07-b3fd-ad45696c609e
Stored capture screenshot: https://i.ibb.co/rGSV1KNT/2a24d03f25b6.png
Cloudflare Radar screenshot (2026-10-23T12:57:53Z): https://screenshots.phishdestroy.io/cf/b456171e-c6fd-4c07-b3fd-ad45696c609e.png
VirusTotal report: https://www.virustotal.com/gui/domain/link-htx.com.cn
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=link-htx.com.cn
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-23 13:00:00 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/rGSV1KNT/2a24d03f25b6.png
  Captured: 2026-10-23 12:56:22 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a168d3-e723-7729-9260-376eb86fecc7.png
  Captured: 2026-10-23 12:56:22 UTC
  Source report: https://urlscan.io/result/01a168d3-e723-7729-9260-376eb86fecc7/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b456171e-c6fd-4c07-b3fd-ad45696c609e.png
  Captured: 2026-10-23 12:57:53 UTC
  Source report: https://radar.cloudflare.com/scan/b456171e-c6fd-4c07-b3fd-ad45696c609e
  SHA-256: 5268f9bbfd7415ea098f6b6644b61c94005daef04443e0bd1f03aaf5341e5920
- URLQuery: https://screenshots.phishdestroy.io/uq/942c5f39-0cdf-40e7-8ff5-0d6c9fc0a34a.png
  Source report: https://urlquery.net/report/942c5f39-0cdf-40e7-8ff5-0d6c9fc0a34a
  SHA-256: aab55eb89a1874304e92360feefbdd04643ed106f4f4838e694c8d9ace5da115
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a168dc-582d-74fb-adcf-c5ce889d2362.png
  Captured: 2026-10-23 13:04:09 UTC
  Source report: https://urlscan.io/result/01a168dc-582d-74fb-adcf-c5ce889d2362/
  SHA-256: ea83c3cd1eb87f57b7542c38f11b33c40c08823ebb5327448ad60f6d50129619

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T12:59:00Z",
        "uuid": "01a168d3-e723-7729-9260-376eb86fecc7",
        "scanned_at": "2026-10-23T12:54:46Z",
        "final_url": "https://link-htx.com.cn/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://link-htx.com.cn/",
                "from": "http://link-htx.com.cn/",
                "status": 307
            }
        ],
        "ip": "172.67.210.1",
        "ips": [
            "172.67.210.1"
        ],
        "asns": [
            "13335"
        ],
        "link_domains": [
            "www.link-htx.com.cn"
        ],
        "doc_hash": "1e9ba2cce8869a638796a41a656c62438dfe740aac2cb0f9154b6b39aba2ac6e",
        "cookies": [
            "server_session_7d25baa6"
        ],
        "tls": {
            "san": [
                "*.link-htx.com.cn",
                "link-htx.com.cn"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "link-htx.com.cn",
            "protocol": "QUIC",
            "valid_to": "2027-01-20T09:56:29Z",
            "valid_from": "2026-10-22T09:56:30Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 3,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 86,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T12:59:01Z",
        "uuid": "b456171e-c6fd-4c07-b3fd-ad45696c609e",
        "scanned_at": "2026-10-23T12:57:53Z",
        "final_url": "https://link-htx.com.cn/",
        "status": 200,
        "history": [
            {
                "url": "https://link-htx.com.cn/",
                "status": 200
            }
        ],
        "dom_hash": "acf5b158b2553b028c6cf2ab1054569fe74f4fb80038482795e431a67a1eb357",
        "doc_hash": "d696cebf935beb87276dcac60bde71ba11366b784f2fde36da746a200c3fb478",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "link-htx.com.cn",
                "type": "A",
                "value": "172.67.210.1"
            },
            {
                "name": "link-htx.com.cn",
                "type": "A",
                "value": "104.21.58.237"
            },
            {
                "name": "link-htx.com.cn",
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:d201"
            },
            {
                "name": "link-htx.com.cn",
                "type": "AAAA",
                "value": "2606:4700:3031::6815:3aed"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.210.1",
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-10-22T18:25:29Z",
            "expires": "2027-10-22T18:25:29Z",
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T12:57:08Z",
        "analysis_at": "2026-10-22T17:32:24Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "first_seen": "2026-10-22T11:05:05Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::6815:3aed"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "austin.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.210.1"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.58.237"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "emma.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "austin.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:d201"
            }
        ],
        "dns_at": "2026-10-22T17:45:08Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.link-htx.com.cn",
                "link-htx.com.cn"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "5c948980ad1bc5e8c0c77ce0ff3307d6126",
            "sha256": "c349531081057649957dad87c1c3c7babf4e1efcfa9d3514d4d7689cafd45d62",
            "subject": "link-htx.com.cn",
            "valid_to": "2027-01-20T09:56:29Z",
            "valid_from": "2026-10-22T09:56:30Z"
        },
        "whois": {
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "austin.ns.cloudflare.com",
                "emma.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T12:59:18Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "link-htx.com.cn"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-23T12:58:42Z",
            "first": "2026-10-23T12:58:42Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 10819
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://www.link-htx.com.cn/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 1
        },
        "social_tags": {
            "title": "火币 - htx - 火币交易所中文版",
            "author": "火币 htx",
            "ogType": "website",
            "robots": "index, follow, max-image-preview:large, max-snippet:-1",
            "ogTitle": "火币 htx 安卓 App 下载｜注册入口与安全交易平台指引",
            "keywords": "火币,htx,火币htx,htx下载,火币安卓下载,htx注册,火币注册,数字资产交易平台,比特币,以太坊,Web3钱包",
            "ogSiteName": "火币 htx",
            "themeColor": "#000000",
            "description": "火币 htx 官方指引页面，提供安卓 App 下载入口与账号注册通道。支持比特币 BTC、以太坊 ETH 等数字资产行情查看与交易服务，多重安全防护，操作简洁高效，7×24 小时全天候服务。",
            "twitterCard": "summary",
            "ogDescription": "安卓 App 下载与账号注册一站式入口，多重安全防护，简洁高效的数字资产服务体验。"
        },
        "trackers": {
            "requests": 1
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 2,
                "tls": 43,
                "wait": 654,
                "connect": 6,
                "download": 0
            },
            "response_ms": 705
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 33230,
            "co2_grams": 0.0012,
            "cleaner_than": 46
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.192.112",
                    "host": "emma.ns.cloudflare.com"
                },
                {
                    "ip": "173.245.59.70",
                    "host": "austin.ns.cloudflare.com"
                }
            ],
            "zone": "link-htx.com.cn"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "server_session_7d25baa6",
                    "secure": true,
                    "http_only": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "2606:4700:3032::ac43:d201",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "link-htx.com.cn"
        },
        "dns": {
            "A": [
                "172.67.210.1",
                "104.21.58.237"
            ],
            "NS": [
                "austin.ns.cloudflare.com",
                "emma.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"austin.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418239959, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3031::6815:3aed",
                "2606:4700:3032::ac43:d201"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000",
            "message": "HSTS header does not include all subdomains."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=31536000",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3031::6815:3aed",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://link-htx.com.cn"
            ]
        },
        "tech_stack": {
            "technologies": [
                "HSTS",
                "Cloudflare",
                "Open Graph",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "external": [
                "https://www.link-htx.com.cn/index.html"
            ],
            "external_count": 1,
            "internal_count": 5
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-10-22T16:25:29Z",
            "expires": "2027-10-22T16:25:29Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "emma.ns.cloudflare.com",
                "austin.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html",
                "strict-transport-security": "max-age=31536000"
            }
        }
    }
}
```