app-trendex[.]xyz

This domain, app-trendex.xyz, was created on 17 October 2025 through NiceNIC International Group Co., Limited and is currently hosted on Cloudflare’s network (AS13335) at IP 172.67.216.222, an address located in the United States. The site has been taken offline, but historical analysis shows that the page title returned “Nur einen Moment…”, a phrase that offers no clear indication of the intended victim‑facing content. No TLS certificate was presented during the brief scan, meaning the connection would have been unencrypted. The domain is listed on the PhishDestroy blocklist and appears on one additional security blocklist, confirming that at least one reputable anti‑phishing feed has flagged it.

VirusTotal records indicate that eight of ninety‑five scanning engines flagged the domain, reinforcing the suspicion of malicious intent. Gridinsoft assigned a trust score of zero out of one hundred, the lowest possible rating, which further corroborates the lack of legitimacy. The nameservers jaziel.ns.cloudflare.com and linda.ns.cloudflare.com resolve to Cloudflare, a common choice for fast‑deployment phishing infrastructure. Because the domain is already offline, immediate mitigation for active traffic is not required, but defenders should still add the domain and its associated IP address to outbound and inbound deny lists, monitor for re‑registration or the appearance of similarly named domains, and enforce strict TLS inspection policies to prevent future unencrypted connections.

Continuous watch of Cloudflare‑hosted IP ranges for abnormal request patterns is advised. At present, no additional intelligence such as Safe Browsing, OTX, or brand‑specific targeting has been observed, leaving the exact phishing campaign details uncertain. Organizations should treat this indicator as a confirmed generic phishing threat and incorporate it into broader threat‑intel feeds.