hararefxmarket[.]xyz[.]fixprotrade[.]xyz

The domain hararefxmarket.xyz.fixprotrade.xyz was registered on March 08 2025 through COSMOTOWN, INC. It resolves to the IPv4 address 163.61.188.5 and is served by four authoritative name servers (dns1.lytehosting.com, dns2.lytehosting.com, dns3.lytehosting.com, dns4.lytehosting). The domain is currently listed as active and is classified as a high‑risk generic phishing operation. Detection activity shows that ten of ninety‑one security vendors on VirusTotal have flagged the domain as malicious, indicating a measurable detection rate of roughly 11 %.

The domain is also present on a single external security blocklist and has been explicitly blocked by the PhishDestroy service. No additional public threat‑intel sources such as OTX or Google Safe Browsing have been referenced in the supplied data, and no SSL certificate details or HTTP response codes are available. The limited infrastructure footprint—single IP address and a set of LyteHosting name servers—suggests a low‑cost hosting environment commonly used for short‑lived phishing campaigns. Because the domain appears to be actively used for phishing, defenders should add the domain and its resolving IP to network‑level deny lists, enforce DNS sinkholing where possible, and monitor for any related sub‑domains that may be created under the same registrar or name‑server configuration.

Continuous re‑scanning with multi‑vendor platforms such as VirusTotal is recommended to capture any changes in detection status. Organizations that rely on email or web gateways should ensure that the domain is included in URL filtering policies and that any credential‑capture attempts originating from this host are logged and investigated. The high risk rating, combined with the observed vendor detections and blocklist presence, warrants immediate remediation to prevent credential theft or further compromise.