apps-compound[.]xyz

On July 12, 2026, the domain apps-compound.xyz was flagged as a high‑risk brand impersonation campaign targeting Compound. The site responds with HTTP 403 and displays a generic page titled "Just a moment...". Registration data shows the domain was created on April 14, 2026 through Dynadot LLC, and the authoritative nameservers are fatima.ns.cloudflare.com and rick.ns.cloudflare.com. DNS resolution points to the IP address 188.114.97.3, which is operated by Cloudflare in Canada, and the TLS handshake uses a Let’s Encrypt certificate (E7).

Infrastructure analysis shows a Gridinsoft trust score of 0 out of 100, indicating a lack of reputation. The domain appears on one security blocklist and has been blocked by PhishDestroy. It is referenced in a single AlienVault OTX pulse, and VirusTotal reports three out of ninety‑five scanners flagging the domain as malicious. These indicators collectively suggest an active malicious infrastructure rather than an isolated test.

The observable evidence confirms the domain’s purpose as a brand‑impersonation vector. The use of Cloudflare’s edge network, combined with a low‑trust score and multiple detections, points to a deliberate effort to hide malicious content behind a reputable CDN. The generic page title provides no functional clue about the payload, leaving the exact phishing mechanism uncertain. No additional artifacts, such as malicious payload hashes or specific phishing kits, have been disclosed, which limits current attribution.

Defenders should immediately add apps-compound.xyz to DNS block lists and endpoint URL filters, enforce TLS inspection to capture any hidden traffic, and monitor for any outbound connections to the IP 188.114.97.3. Continuous threat‑intel feeds should be consulted for future detections, and any observed credential submissions to the domain should be investigated as potential compromise attempts.