sso-portal-htexchange-us[.]pages[.]dev

Analysis of sso-portal-htexchange-us.pages.dev shows an active high‑risk brand‑impersonation operation that mimics a cryptocurrency exchange. The site resolves to IP 188.114.96.3, a Cloudflare‑owned address located in Canada, and uses Cloudflare’s edge services, including HSTS, HTTP/3, and a Google Trust Services certificate issued to WE1. The page title "HTX | Buy Bitcoin & Ethereum | Crypto Exchange" and the declared brand target of Ethereum indicate a fake exchange designed to lure investors. The domain was created on May 01, 2026 and is hosted on Cloudflare name servers leanna.ns.cloudflare.com and vick.ns.cloudflare.com. Security telemetry records four of ninety‑one VirusTotal scanners flagging the domain, and Gridinsoft assigns a trust score of zero out of one hundred, confirming malicious intent. The site is already listed on a security blocklist and has been blocked by PhishDestroy. While the exact phishing workflow and credential collection mechanisms have not been publicly detailed, the combination of recent registration, Cloudflare‑based hosting, and a page title that advertises cryptocurrency trading aligns with known fake‑exchange kits. Defenders should block the domain at DNS and web‑proxy layers, monitor outbound connections to the associated IP, and add the domain to internal threat‑intel feeds. Continuous observation of any new indicators, such as additional phishing kit signatures or victim reports, is recommended to adjust mitigation controls promptly.