app-iopn[.]xyz

Analysis of the domain app-iopn.xyz reveals it is associated with high-risk phishing activity. The domain, created on March 13, 2026, is currently active and has been detected in 23 threat intelligence pulses within AlienVault OTX, indicating it has garnered significant attention in the threat landscape. It has a low trust score of 0/100 on Gridinsoft, which corroborates its potentially malicious nature. Furthermore, the security vendor community flags this domain, with 16 out of 95 vendors on VirusTotal identifying it as a threat. This level of consensus among security tools suggests that app-iopn.xyz poses a significant risk to users.

The domain is registered through Dynadot LLC and employs Cloudflare infrastructure, utilizing HTTP/3 protocols. It resolves to the IP address 104.21.60.126. The presence of an SSL certificate issued by Let's Encrypt does not imply safety, as attackers frequently use such certificates to enhance the legitimacy of their operations. Additionally, this domain has been blocked by multiple security solutions, including SEAL, MetaMask, PhishDestroy, and BLP-Malware, further indicating its role in phishing campaigns. It also appears on four security blocklists, reinforcing the perception of its malicious intent.

Given the evidence, it is critical for organizations and individuals to exercise heightened caution regarding interactions with app-iopn.xyz. Users should avoid providing any personal or sensitive information to this domain, and security teams should implement technical controls to block access to this and similar domains. Monitoring for any changes in behavior or associated infrastructures may also provide insights into ongoing phishing tactics that employ this domain.