houbi[.]co

This domain, houbi.co, poses a high-risk brand impersonation threat targeting users of the HTX cryptocurrency exchange. The site falsely presents itself as an official platform by offering crypto rewards under the guise of OKX, a legitimate exchange, using a referral code (97597037) to lure victims. The page title explicitly reads 'Earn rewards when you get started on OKX | My referral code: 97597037 | OKX Europe,' which is a clear attempt to deceive users into believing they are interacting with a trusted service. Such impersonation schemes typically aim to harvest login credentials, steal funds, or distribute malware under the pretense of promotional offers. Analysis of the domain’s infrastructure and threat indicators confirms its malicious nature. houbi.co is flagged by 11 out of 95 security vendors on VirusTotal, including detections for social engineering tactics. The domain was registered on April 25, 2026, through Dynadot Inc, a registrar frequently associated with fraudulent activities. It resolves to the IP address 54.215.31.113 and employs technologies such as Nginx, React, and OpenResty, which are common in both legitimate and malicious sites but are often exploited in phishing campaigns. Additionally, the domain appears on two security blocklists, is referenced in one AlienVault OTX threat intelligence pulse, and has a Gridinsoft trust score of 0/100, further validating its high-risk classification. Users who have visited houbi.co should take immediate action to mitigate potential risks. First, avoid entering any personal information or credentials on the site, as it is confirmed to be fraudulent. If any login details or financial information were submitted, reset passwords for all associated accounts, especially those tied to cryptocurrency exchanges, and enable multi-factor authentication where possible. Monitor financial statements and crypto wallets for unauthorized transactions. Report the domain to relevant authorities or cybersecurity organizations to aid in takedown efforts. Given its current offline status, users should remain vigilant for similar scams, as threat actors often rebrand or relaunch such schemes under new domains.