htx-login[.]ru

The domain www.htx-login.ru is a confirmed phishing site engaged in brand impersonation, specifically targeting Apple users under the guise of technical support. Despite its appearance, the site does not represent Apple or any legitimate service; it was designed to deceive visitors into divulging credentials or personal information. As of the latest verification, www.htx-login.ru has been taken offline, though its prior activity remains a documented threat.

Technical analysis reveals that www.htx-login.ru was flagged by 2 of 95 security vendors on VirusTotal, including SOCRadar and Webroot, while Google Safe Browsing did not detect it. The domain was registered through R01-RU on July 10, 2025, and resolved to the IP address 45.10.243.7, hosted by AS57724 (DDoS-Guard LTD) in Russia. It appeared on 1 security blocklist, PhishDestroy, and used an SSL certificate issued by Let's Encrypt (R12). The observed page title, 'Вход в HTX | Войти в аккаунт HTX Exchange,' misrepresented itself as a login portal for HTX Exchange, further indicating its deceptive intent. Technologies detected on the site included Node.js, Vue.js, Nuxt.js, jQuery, Hammer.js, and DDoS-Guard.

Individuals who interacted with www.htx-login.ru should immediately change any passwords entered on the site and enable two-factor authentication on all sensitive accounts. Monitor financial and digital accounts for unauthorized activity, and report the incident to Apple’s official security team via their phishing reporting page. Additionally, victims may submit the domain to platforms like Google Safe Browsing, PhishTank, or their local cybercrime unit to aid in broader threat mitigation.