hazedex[.]com

Analysis of hazedex.com, registered on May 09, 2025 through GMO Internet, Inc., indicates an active brand‑impersonation campaign targeting the x.com social media platform. The domain resolves to IP address 69.5.189.54, which belongs to ASN 42624 (Global‑Data System IT Corporation) and is geolocated in Switzerland. Network infrastructure is served by Nginx with OpenResty, and the TLS certificate is issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority – G2. The domain is listed on a single security blocklist and has been flagged by PhishDestroy, which subsequently took the site offline; its current HTTP status is therefore unavailable.

Reputation scoring from Gridinsoft assigns a zero out of one hundred trust rating, reflecting extreme suspicion. Threat intelligence sources show the domain appearing in one AlienVault OTX pulse and being detected by a single vendor on VirusTotal (1 / 95). The page title returned by the server is the literal string “hazedex.com”, providing no further contextual clues about the page’s content or malicious payload. The campaign is classified as social‑media phishing, with the explicit intent to deceive users of x.com, though the exact phishing vector (login page, credential‑harvesting form, etc.) has not been publicly captured.

Defenders should prioritize adding the host and associated IP to outbound blocklists, enforce TLS inspection to detect any malformed certificates, and monitor for newly registered domains using the same registrar, nameserver set (ns1‑ns4.nameserverhub.com), or similar IP ranges. Continuous telemetry from endpoint protection platforms should be tuned to flag any interaction with the x.com brand that originates from this infrastructure. Given the low visibility of the site content, analysts are advised to request full page captures from web‑archiving services to confirm the phishing tactic and to share any newly observed indicators with industry‑wide blocklists.