apiredir[.]xyz

Analysis indicates that the newly registered domain apiredir.xyz was created on July 17, 2026 and is currently pointing to the IPv4 address 75.2.60.5. The domain is listed on a single security blocklist and has been blocked by the PhishDestroy service, suggesting that it is being used in a phishing operation. Registration details show the registrar as NICENIC INTERNATIONAL GROUP CO., LIMITED, and the authoritative name servers are ns3.my-ndns.com and ns4.my-ndns.com. A VirusTotal scan involving 95 antivirus and URL‑reputation engines returned no detections at the time of the scan; this absence of flags does not constitute a safety statement and should be interpreted as a lack of current signatures rather than evidence of benign behavior. No public SSL certificate information, HTTP status codes, or page title data are presently available, limiting visibility into the content hosted on the IP address. The limited intelligence suggests a typical low‑profile phishing infrastructure that relies on a fresh domain, a third‑party DNS provider, and a single‑IP hosting arrangement. Defenders should treat apiredir.xyz as a high‑confidence indicator of compromise. Immediate actions include adding the domain and its resolving IP address to outbound and inbound deny lists, enforcing DNS‑based blocking, and monitoring network traffic for connections to 75.2.60.5. Continuous re‑scanning with VirusTotal or similar multi‑engine platforms is advised to capture any future detections. Analysts should also watch for newly observed sub‑domains under the same registrar or name‑server pair, as the operators may spawn additional payload sites. Logging DNS queries for the domain and correlating them with user authentication attempts can aid in detecting successful phishing attempts. Given the active status as of July 20, 2026, ongoing vigilance is required.