Is hackear.mx safe?

A hacking tool that only pretends to work

The site's core offer is unauthorized access to someone else's account. The headline invites visitors to pick the social network they want to "HACKEAR", and the page text tells a reader they will "ingresar a la cuenta de tu pareja" by selecting the network from a list. Platform buttons for Facebook, Instagram, Messenger, WhatsApp, Gmail and TikTok sit above a form field labelled "Introduce URL del perfil a hackear".

Pressing "Hackear" produces a panel with a generic silhouette avatar and the text "Esperando Información..." with loading dots — a canned progress state, not a verifiable technical process. Nothing on the captured pages shows any real capability behind the claim, and the page's own copy promises access "rápido, seguro y garantizado", which no such tool can deliver.

The practical effect is that visitors hand over a third party's profile URL — and, through the contact form, their own name, email and message — to an operator who names no company, registration number or email address. The only contact data is a phone number and three social profile links.

The hand-off to hackearonline.net

After promising guaranteed access, the page recommends another site: "También te recomendamos la página top 1 de hackeos en internet 👉 https://hackearonline.net/". That is a link to a different registrable domain, and the page says nothing about whether it is an affiliate, a referral partner or the same operator under another name.

Independent research on that destination is adverse: a URL-scanner page classifies hackearonline.net as a fraudulent site based on several risk signals, including two blacklist detections. The same research records the domain as registered in September 2021 through NameSilo, with monthly traffic in the low tens of thousands of visits.

Clean connection checks do not make this safe

Some technical checks are clean: the browser threat feed returned no threat warning at scan time, a valid TLS certificate exists for the host, and the hosting IP carries an abuse confidence score of 0/100 across no saved reports. The domain is also roughly five years old, which is longer than most throwaway scam domains last.

Those results do not vouch for the operator. A saved antivirus aggregate records two adverse engine results among 93 — Seclookup as malicious and Yandex Safebrowsing as phishing — and the site is served over plain HTTP with no redirect to HTTPS, so anything typed into the profile-URL field or the contact form travels unencrypted.

The decisive problem is what the site asks people to do, not what a scanner sees. It advertises breaking into other people's accounts, presents a simulated result as if it were real, and routes visitors onward to a second domain that independent research describes as fraudulent — all without disclosing who runs either site.