htxexchange[.]live

The domain htxexchange.live was registered on June 5, 2025 through Web Commerce Communications Limited and is currently taken offline. DNS resolution points to the IP address 172.67.168.48, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No SSL certificate is presented for the host, indicating that HTTPS connections are not available. The site’s page title, as captured by external scanners, reads “HTX Exchange - Cryptocurrency Exchange for Bitcoin, Ethereum & Altcoins,” suggesting an attempt to masquerade as a legitimate cryptocurrency platform and specifically to impersonate the Ethereum brand.

Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence in malicious intent. The domain appears on one security blocklist and is listed as blocked by PhishDestroy. VirusTotal analysis reports five detections out of ninety‑five scanning engines, providing additional corroboration of suspicious activity. The limited number of detections may be due to the domain’s recent creation and brief operational window before being taken offline.

Infrastructure analysis shows reliance on Cloudflare’s CDN, a common tactic for fast‑flux or evasive hosting, but the lack of TLS further reduces the site’s credibility and may aid detection. Defenders should immediately block the domain and its associated IP address at perimeter defenses, add the host to URL filtering and threat‑intel feeds, and monitor Cloudflare‑owned address ranges for similar impersonation attempts. Continuous re‑scanning of the domain, especially if it reappears, is advised to capture any changes in payload or hosting. Because the page content has not been publicly disclosed, analysts should treat the observed indicators—registration data, IP association, blocklist status, low trust score, and brand‑impersonation flag—as sufficient justification for heightened vigilance against related crypto‑focused phishing campaigns.