hxyhxy[.]sbs

PhishDestroy identifies the domain hxyhxy.sbs as an active credential phishing threat designed to harvest user login credentials under false pretenses. The site currently remains online and operational as of evaluation, posing a direct and measurable risk to individuals and organizations that may encounter it through email campaigns, social media links, or fraudulent advertisements. While the exact impersonated brand or service has not yet been confirmed through open-source intelligence, the site’s structure and metadata indicate a high likelihood of masquerading as a legitimate login portal to deceive visitors into surrendering sensitive authentication details. Immediate avoidance is strongly advised. This domain—registered on August 21, 2025, through Global Domain Group LLC—was detected resolving to IP address 67.215.241.243 and secured with an SSL certificate issued by TrustAsia Technologies, Inc. As of this analysis, VirusTotal shows zero detections across 95 scanning vendors, highlighting a window of opportunity for threat actors to exploit unprotected traffic before widespread blacklisting occurs. The domain has not yet appeared on major threat intelligence blocklists, suggesting it may be newly operational or carefully segmented to evade early detection systems. The combination of a recent creation date, low detection coverage, and active infrastructure signals a potentially high-risk phishing operation with evolving tactics. Given the absence of current blocklist inclusion and low antivirus coverage, hxyhxy.sbs represents an unchecked phishing threat that could rapidly expand its reach. Users are advised to avoid visiting the domain and report any encounters to relevant security teams using the provided IP and domain indicators. Organizations should consider proactive blocking of 67.215.241.243 and hxyhxy.sbs at network and DNS levels, while conducting heightened phishing awareness training focused on newly registered domains with suspicious SSL certificates. Continuous monitoring through threat intelligence feeds is recommended to detect any shifts in infrastructure or campaign expansion. The domain remains under active investigation by PhishDestroy’s anti-phishing team.