apikey[.]to

The domain apikey.to has been identified as a phishing infrastructure impersonating Open WebUI, a web-based user interface often associated with authentication or API management platforms. This domain is classified as a generic phishing threat with an elevated risk level. As of the latest analysis, the domain has been taken offline, though prior activity suggests it was actively used to harvest sensitive credentials or API keys. Infrastructure analysis reveals that apikey.to was flagged by 3 of 95 security vendors on VirusTotal, indicating detection by a minority of engines but still sufficient to warrant concern. The domain was registered through NAMECHEAP INC on April 04, 2026, and resolved to the IP address 47.83.186.54. It appears on three security blocklists, including high-confidence sources, and holds a Gridinsoft trust score of 0/100. The SSL certificate is issued to an unspecified organization, a common tactic to lend superficial legitimacy to phishing pages. The page title, 'Open WebUI,' directly mimics the branding of legitimate interfaces, increasing the likelihood of successful deception. Given the domain's current offline status, immediate threats from apikey.to are mitigated. However, organizations should remain vigilant for similar infrastructure or re-emergence of this domain. Recommended actions include monitoring for DNS resolution changes, blocking the IP address 47.83.186.54 at perimeter defenses, and alerting users to the impersonation of Open WebUI. Security teams should also review logs for prior connections to this domain or its associated IP to assess potential compromise. Proactive measures, such as domain monitoring and credential rotation for potentially exposed accounts, are advised.