huobi[.]world

huobi.world is an active domain registered on June 8, 2026 through the registrar Spaceship. The site presents a page title rendered in Chinese characters – “火币交易所 | 数字资产交易平台_加密货币交易平叔 – and is explicitly crafted to impersonate the cryptocurrency exchange brand HTX. The domain’s short lifespan and recent registration suggest it was created for a targeted brand‑impersonation campaign. The hosting infrastructure resolves to the IP address 188.114.96.3, which belongs to CloudFlare, Inc. and is geolocated to Canada. TLS is provided by Google Trust Services under the WE1 certificate, indicating the use of a reputable certificate authority to enhance credibility. An HTTP GET request returns status code 200, confirming that the site is actively serving content. Threat‑intel sources corroborate malicious intent. AlienVault OTX lists the domain in four separate pulses, and three independent blocklists (PhishDestroy, MetaMask, SEAL) have already flagged it. VirusTotal analysis shows that 15 of 95 scanned security vendors classify the domain as malicious, while Gridinsoft assigns a trust score of 0 out of 100. The campaign is categorized as a “Crypto Drainer,” implying that the site likely attempts to lure victims into authorizing transfers of digital assets to attacker‑controlled wallets. Defenders should immediately add huobi.world to network‑level deny lists and configure DNS filtering to block resolution. Security operations teams are advised to monitor for any outbound connections to the IP 188.114.96.3 and to inspect logs for attempts to interact with HTX‑related endpoints originating from internal users. Incident response playbooks for crypto‑drainer scams should be invoked, and any compromised credentials should be rotated and investigated for unauthorized blockchain transactions.