app-tydro[.]xyz

Analysis of app-tydro.xyz indicates an active phishing domain operating under Cloudflare protection. The domain was registered on March 3, 2026, through Dynadot LLC and currently resolves to 188.114.96.3, an IP address assigned to AS13335 (Cloudflare, Inc.). Nameservers alexa.ns.cloudflare.com and randall.ns.cloudflare.com confirm Cloudflare as the hosting provider, which is consistent with observed HTTP/3 support and a Google Trust Services SSL certificate (WE1). As of July 12, 2026, the domain returns an HTTP 403 status with a page title of 'app-tydro.xyz | 504: Gateway time-out,' suggesting either misconfigured backend infrastructure or deliberate access restrictions. Despite the error response, the domain remains flagged by 23 threat intelligence pulses in AlienVault OTX and appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. One of 93 security vendors on VirusTotal has detected the domain as malicious, though the specific payload or phishing kit remains unconfirmed. The domain’s trust score of 0/100 further supports its classification as high-risk infrastructure. While the exact target (e.g., financial, cryptocurrency, or credential harvesting) is not yet determined, the use of Cloudflare nameservers and a recent registration date align with common phishing tactics to evade detection. Defenders should treat this domain as active phishing infrastructure and block or monitor traffic to 188.114.96.3 and associated subdomains. Further analysis of SSL certificate logs or passive DNS may reveal additional linked infrastructure.