api[.]powerups[.]club

The domain api.powerups.club was registered on February 21, 2026 via Gandi SAS and is hosted on a Render infrastructure (AS397273) located in the United States, resolving to IP address 216.24.57.7. HTTP requests to the domain returned a 200 status code, indicating that a web service was actively responding before the infrastructure was taken offline. The service stack identified through passive fingerprinting consists of Node.js running Express, fronted by Cloudflare with HTTP/3 support, suggesting a modern web application delivery platform. Security telemetry shows the domain appears on a single security blocklist and has been actively blocked by the PhishDestroy sinkhole, confirming its use in malicious campaigns.

VirusTotal analysis reports 14 of 93 scanning engines flagging the domain as malicious, reinforcing the suspicion of abusive activity. The SSL certificate is issued by Google Trust Services under the WE1 certificate authority, which is commonly used for legitimate sites, indicating the attackers obtained a valid certificate to improve trustworthiness. Gridinsoft assigns the domain a trust score of 1 out of 100, the lowest possible rating, reflecting a high confidence in malicious intent.

No page title or content analysis is available, leaving the exact phishing payload or delivery scam mechanics unconfirmed. Defenders should immediately block the domain and its associated IP address, continue monitoring for any re‑activation, and include the domain in threat‑intel feeds. Additional investigation of the hosting provider’s other Render instances may reveal related infrastructure, and correlation with the 14 VirusTotal detections could provide indicator enrichment for broader campaign detection.