hd-streamz.xyz is an impersonation phishing page dressed up as a download portal for HD Streamz, an unofficial Android streaming app. It targets sports fans looking for free live channels. PhishDestroy first flagged it on 2026-09-19. The site went offline on 2026-09-20 and was still dead when last checked on 2026-10-19.
How the scam works
The page advertised itself as "HD Streamz APK v3.11.0 Download & Enjoy Live Sports Channels." That promise draws visitors into sideloading an Android package from outside any app store. Fake APK portals like this exploit an app that already lives outside official stores, so users expect a direct download and skip the usual checks. Visitors who install a rogue package can hand over device access, saved logins or other personal data. They may also be pushed through further pages that harvest credentials. The bait is a free stream, but the cost can be control of the phone and the accounts on it.
Evidence
Engine coverage was thin. On 2026-09-19, VirusTotal showed 2 of 89 engines flagging the domain: alphaMountain.ai and Forcepoint ThreatSeeker. Curated lists carry more weight here. Besides PhishDestroy, the domain appears on the MetaMask and SEAL blocklists, both maintained by teams focused on protecting crypto users. Their independent listings support the classification even though most antivirus engines stayed silent.
Infrastructure
The domain was registered through Spaceship, Inc. on 2026-06-13, roughly three months before PhishDestroy detected it. It resolved to 88.222.222.27 on Hostinger International Limited's network in Lithuania. Its certificate came from Let's Encrypt, so the padlock in the browser said nothing about whether the site was legitimate. The site collapsed one day after detection, which fits a short-lived, disposable lure.
What to do
If you downloaded and installed an APK from this site, uninstall it right away and run a full scan with a reputable mobile security tool. Review which apps hold accessibility or device-admin permissions. Change the passwords for any accounts used on that phone, and turn on two-factor authentication where you can. If you typed credentials into the page, change them immediately and watch those accounts for unfamiliar sign-ins. Defenders should block the domain and its IP address, and should treat unofficial streaming-APK downloads as a recurring vector for malware and credential theft.
DOM Analysisanalyzed 2026年9月19日score 78/1004 brand signals
Submitted URLhttp://hd-streamz.xyz/
Favicon Hash
ケース ID
ICANN OVERSIGHT
認定と RAA の背景
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Certificate fingerprint7ff1ed8a44ba0b5d7d42c98925e0e20701f214b27d14531aca7e5d037162cdb5Certificate names · 1 SANs
www.hd-streamz.xyz
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Hostnames retained in the domain record or Certificate Transparency cache. A hostname alone does not establish current availability or malicious activity.
www.hd-streamz.xyzDomain record
The original observation time is not recorded for these hostnames.
使用技術 · 7 identified
W
WordPress
CMSBlogs
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
