app-heyanon[.]xyz

Analysis of app-heyanon.xyz indicates a high-risk phishing domain currently active as of July 12, 2026. The domain was registered on March 13, 2026, through Dynadot LLC and remains unresolved with a 504 Gateway Time-out error, suggesting either deliberate obfuscation or recent takedown attempts. Infrastructure analysis reveals Cloudflare hosting and HTTP/3 protocol usage, resolving to IP 172.67.142.220. The domain appears on two security blocklists and is flagged by 14 of 95 security vendors in VirusTotal scans, while AlienVault OTX records it in 23 threat intelligence pulses. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious domains. No specific brand or scam subtype is confirmed in available data, though the page title and timeout behavior may indicate a phishing infrastructure in transitional state. Defenders should treat this domain as hostile, block resolution at network level, and monitor for changes in page content or resolution status. The combination of Cloudflare hosting, recent registration, and multi-source blocklist presence supports classification as malicious, despite the current timeout state.