htex-panel[.]at

The domain htex-panel.at was created on June 05, 2025 and is currently taken offline. DNS resolution points to the address 186.2.175.59, which belongs to the BZ region under ASN 59692 (IQWeb FZ‑LLC). The authoritative name servers are pns61.cloudns.net, pns62.cloudns.com, pns63.cloudns.net, and pns64.cloudns.uk. A Let's Encrypt R13 certificate secures the site, indicating that TLS was offered at the time of observation.

Web‑technology fingerprints show a WordPress stack backed by MySQL and PHP, with DDoS‑Guard present, suggesting an attempt to mitigate traffic spikes. The page title returned by the server – “HTX Login | Secure Sign In to HTX Crypto Exchange” – aligns with a credential‑phishing narrative, and the domain is explicitly catalogued as impersonating Apple, targeting the brand for credential theft. Security products PhishDestroy and CryptoFirewall have both blocked the domain, and it appears on two external blocklists. AlienVault OTX references the domain in seventeen threat‑intelligence pulses, reinforcing the malicious attribution.

VirusTotal analysis recorded seventeen detections out of ninety‑five scanning engines, confirming that multiple vendors consider the domain malicious. While the available data confirm the infrastructure, hosting, and detection history, the exact content of the login page and the mechanism for harvesting Apple credentials have not been publicly disclosed; the registrant information is also omitted. Defenders should continue to block htex-panel.at at DNS and proxy layers, add its IP 186.2.175.59 to network‑level deny lists, monitor for any resurgence of the domain or its name‑servers, and enforce TLS inspection to capture any future payloads. Ongoing threat‑intel correlation with OTX pulses and blocklist updates is advised to capture related campaign artifacts.