# PhishDestroy domain threat record: wto-htx.com.cn

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/wto-htx.com.cn/
Machine-readable companion: https://phishdestroy.io/domain/wto-htx.com.cn/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 11:55:40 UTC
- Last availability or vendor check: 2026-10-26 11:55:40 UTC
- Stored record updated: 2026-10-26 20:16:43 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: HTX

## Stored infrastructure

- Observed IP address: 104.21.74.141
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-24 09:41:14 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1780f-b200-707c-8273-92f65e07de2f/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/wto-htx.com.cn
- Certificate Transparency search: https://crt.sh/?q=%25.wto-htx.com.cn
- Web Archive lookup: https://web.archive.org/web/*/https://wto-htx.com.cn/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
As observed on 2026-10-26, the captured screenshot shows a dark Chinese-language page branded htx火币 that headlines an official-entrance Android package download and package parameters for Huobi HTX, with navigation for installation order, download, registration and FAQs. The page also displayed tiles claiming registered users, tradeable assets, country coverage and 24-hour Chinese-language service. PhishDestroy classified this as impersonation and an impersonation phishing page, first seen by PhishDestroy on 2026-10-26 after a trusted auto intake based on an admin report and AI assessment.

How the scam works
The captured screenshot shows prominent 安卓下载 and 火币注册 buttons next to Android package parameters (v6.92.0, 168MB, Android 6.0 and above), steering visitors toward installing an exchange application obtained outside official channels. As a category risk, such third-party download and registration funnels enable distribution of tampered applications or credential-harvesting sign-up flows while borrowing a real exchange's branding. A top-of-page disclaimer claiming independent third-party status does not remove that install and credential risk.

Evidence
The captured screenshot shows the official-entrance download headline, package parameters, registration buttons and promotional statistics. On 2026-10-26 urlscan flagged it malicious with an ML score of 42 while its overall score was 0; VirusTotal did not flag it; Spamhaus did not list it; Google Safe Browsing did not flag it; OTX recorded 0 pulses. External blocklists MetaMask and SEAL listed the domain and PhishDestroy's internal blocklist flagged it, all checked on 2026-10-26. The HTTP entry funneled to HTTPS with a 307 redirect and no cross-site redirect; site inspection found one tracker request using a Cloudflare beacon and no distinct JavaScript framework, and two separate page SHA256 hashes are recorded for campaign pivoting (04d05978fdb1).

Infrastructure
Hosting is behind Cloudflare with a Cloudflare WAF in front; no registrar identity is recorded. Notable weaknesses: CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP all absent; HSTS present with max-age 31536000 but not covering all subdomains; no SPF, DKIM or DMARC; CAA present; DNSSEC unsigned; TLS 1.3 with TLS_AES_256_GCM_SHA384, forward secrecy and ALPN h2; the certificate was 2 days old at capture.

What to do
If you submitted account details or installed the package from this page, change your password on the genuine exchange service, enable two-factor authentication, and review the device for unfamiliar installed applications. Do not treat the third-party disclaimer or a valid TLS certificate as proof of legitimacy. Defenders should block wto-htx.com.cn at DNS or proxy layers, watch for further HTX-branded lookalike domains, and retain the recorded capture hashes for pivoting.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1780f-b200-707c-8273-92f65e07de2f/
Cloudflare Radar report: https://radar.cloudflare.com/scan/6b6f6fcf-240c-412d-8f71-5ded1d4a21a8
Stored capture screenshot: https://i.ibb.co/LdY2gjRd/dca40a43acbf.png
Cloudflare Radar screenshot (2026-10-26T11:56:18Z): https://screenshots.phishdestroy.io/cf/6b6f6fcf-240c-412d-8f71-5ded1d4a21a8.png
VirusTotal report: https://www.virustotal.com/gui/domain/wto-htx.com.cn
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=wto-htx.com.cn
Archived copy: https://web.archive.org/web/20261026115659/https://wto-htx.com.cn/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 20:16:43 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/LdY2gjRd/dca40a43acbf.png
  Captured: 2026-10-26 11:55:40 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a1780f-b200-707c-8273-92f65e07de2f.png
  Captured: 2026-10-26 11:55:40 UTC
  Source report: https://urlscan.io/result/01a1780f-b200-707c-8273-92f65e07de2f/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/6b6f6fcf-240c-412d-8f71-5ded1d4a21a8.png
  Captured: 2026-10-26 11:56:18 UTC
  Source report: https://radar.cloudflare.com/scan/6b6f6fcf-240c-412d-8f71-5ded1d4a21a8
  SHA-256: f4c34cf401ff45cd0cb30a763556a1b40d175d8f4c1374c55d5ceff745bef295

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T11:57:39Z",
        "uuid": "01a1780f-b200-707c-8273-92f65e07de2f",
        "scanned_at": "2026-10-26T11:54:23Z",
        "final_url": "https://wto-htx.com.cn/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://wto-htx.com.cn/",
                "from": "http://wto-htx.com.cn/",
                "status": 307
            }
        ],
        "ip": "104.21.74.141",
        "domains": [
            "static.cloudflareinsights.com"
        ],
        "ips": [
            "104.16.79.73",
            "104.21.74.141"
        ],
        "asns": [
            "13335"
        ],
        "link_domains": [
            "www.wto-htx.com.cn"
        ],
        "doc_hash": "04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747",
        "globals": [
            "__cfBeacon"
        ],
        "cookies": [
            "server_session_7d25baa6"
        ],
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 2,
        "tls_valid_days": 89,
        "requests": 7,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 42,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "image/png"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T11:57:41Z",
        "uuid": "6b6f6fcf-240c-412d-8f71-5ded1d4a21a8",
        "scanned_at": "2026-10-26T11:56:18Z",
        "final_url": "https://wto-htx.com.cn/",
        "status": 200,
        "history": [
            {
                "url": "https://wto-htx.com.cn/",
                "status": 200
            }
        ],
        "dom_hash": "84d6ec43a3964195cc080bde291da13e94d2534f836b7124f6648ea3e02a7d08",
        "doc_hash": "0bd16aec87a78f9df3ede30987edcea00878cd8d89ea76a825cc91617d3ad51d",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "wto-htx.com.cn",
                "type": "A",
                "value": "172.67.158.251"
            },
            {
                "name": "wto-htx.com.cn",
                "type": "A",
                "value": "104.21.74.141"
            },
            {
                "name": "wto-htx.com.cn",
                "type": "AAAA",
                "value": "2606:4700:3033::6815:4a8d"
            },
            {
                "name": "wto-htx.com.cn",
                "type": "AAAA",
                "value": "2606:4700:3036::ac43:9efb"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.158.251",
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-10-24T11:41:14Z",
            "expires": "2027-10-24T11:41:14Z",
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T11:56:09Z",
        "analysis_at": "2026-10-26T02:54:16Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "first_seen": "2026-10-24T03:52:41Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "emma.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.74.141"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "austin.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::6815:4a8d"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3036::ac43:9efb"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "austin.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.158.251"
            }
        ],
        "dns_at": "2026-10-26T03:06:16Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.wto-htx.com.cn",
                "wto-htx.com.cn"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "683275c65cbf09947aa91b17b107e625fca",
            "sha256": "b7d39f6c97750432eb31db719bee7857b531cd3f899b12483bc7bb27e3fbd003",
            "subject": "wto-htx.com.cn",
            "valid_to": "2027-01-22T02:50:42Z",
            "valid_from": "2026-10-24T02:50:43Z"
        },
        "whois": {
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "austin.ns.cloudflare.com",
                "emma.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T11:57:52Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "wto-htx.com.cn"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-26T11:56:59Z",
            "first": "2026-10-26T11:56:59Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 6557
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://www.wto-htx.com.cn/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 1
        },
        "social_tags": {
            "title": "htx信息导航 - 火币htx第三方信息站 · 简体中文网",
            "ogType": "website",
            "robots": "index,follow,max-image-preview:large",
            "ogImage": "og.svg",
            "ogTitle": "火币htx信息导航站 · 安卓取包参数",
            "keywords": "火币交易所下载",
            "ogSiteName": "火币htx信息导航站",
            "themeColor": "#101915",
            "description": "火币交易所下载,打造智能做市系统。通过app下载接入流动性池,AI动态调整价差。实测做市收益较传统策略提升42%,回撤降低60%。",
            "twitterCard": "summary_large_image",
            "canonicalUrl": "https://www.wto-htx.com.cn/index.html",
            "ogDescription": "安全策略的调整经过灰度验证，先在小部分账户生效，观察期内未出现异常再扩大范围，降低误判带来的影响。"
        },
        "trackers": {
            "requests": 1
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 2,
                "tls": 23,
                "wait": 607,
                "connect": 7,
                "download": 1
            },
            "response_ms": 640
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 15869,
            "co2_grams": 0.0006,
            "cleaner_than": 62
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.193.70",
                    "host": "austin.ns.cloudflare.com"
                },
                {
                    "ip": "173.245.58.112",
                    "host": "emma.ns.cloudflare.com"
                }
            ],
            "zone": "wto-htx.com.cn"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "server_session_7d25baa6",
                    "secure": true,
                    "http_only": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "2606:4700:3036::ac43:9efb",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "wto-htx.com.cn"
        },
        "dns": {
            "A": [
                "172.67.158.251",
                "104.21.74.141"
            ],
            "NS": [
                "emma.ns.cloudflare.com",
                "austin.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"austin.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418472480, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3036::ac43:9efb",
                "2606:4700:3033::6815:4a8d"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000",
            "message": "HSTS header does not include all subdomains."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=31536000",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3033::6815:4a8d",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://wto-htx.com.cn"
            ]
        },
        "linked_pages": {
            "external": [
                "https://www.wto-htx.com.cn/index.html"
            ],
            "external_count": 1,
            "internal_count": 7
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-10-24T09:41:14Z",
            "expires": "2027-10-24T09:41:14Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "emma.ns.cloudflare.com",
                "austin.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html",
                "strict-transport-security": "max-age=31536000"
            }
        }
    }
}
```