fhdub[.]xyz

fhdub.xyz is a phishing domain that has been taken offline but was previously flagged by 16 out of 93 vendors on VirusTotal. This domain, registered with Go Daddy, was hosted on an Amazon IP in the United States. It has been listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL, and was flagged by Google Safe Browsing.

The domain was created on February 21, 2026, but PhishDestroy detected it on January 28, 2026, indicating a proactive identification of the threat. This early detection highlights PhishDestroy's capability to identify malicious domains in the critical window before antivirus databases are updated. Despite its current offline status, the domain's initial activity posed a significant risk to users.

The page title "404: NOT_FOUND" suggests that the site was taken down, likely due to its malicious activity being identified and reported. The use of Let's Encrypt for SSL issuance is common among phishing sites, as it allows for free and easy certificate acquisition, which can lend an appearance of legitimacy to unsuspecting users. The domain's presence on multiple blocklists and its flagging by Google Safe Browsing underscores the threat it posed during its active period.