🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain hdxxax.shop.

Database Entry


IOC ID:1974542
IOC: hdxxax.shop
IOC Type :domain
Threat Type :cc_skimming
Malware: Unknown malware
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS132203 TENCENT-NET-AP-CN
Country:- CN
First seen:2026-10-20 05:14:50 UTC
Last seen:never
UUID:19db123d-cbee-11f1-bd13-42010aa4000a
Reporter lukey03
Reward 5 credits from ThreatFox
Tags:error524 fedex PhaaS smishing
Reference: https://www.group-ib.com/blog/error-524-decoy-smishing/

Avatar
lukey03
FedEx smishing payload site. Vue SPA card/SSN harvesting kit behind fake Cloudflare checkbox gate (/__theme/runtime/site/verify). Live keystroke exfil to operators via WebSocket /ws (input_text/command_ack/command_result). Registered 2026-10-17 via Dynadot, hosted 43.153.64.160 (Tencent Cloud SG). Matches Group-IB Error 524 PhaaS campaign.