app-nado[.]xyz

Analysis of app-nado.xyz indicates a high-risk phishing infrastructure currently active as of July 12, 2026. The domain was registered on March 13, 2026, through Dynadot LLC and is protected by Cloudflare nameservers (jeff.ns.cloudflare.com, naomi.ns.cloudflare.com) and a Let's Encrypt SSL certificate (serial E7). It resolves to 104.21.33.223, an IP address assigned to AS13335 (Cloudflare, Inc.) in the United States. The domain is flagged on three security blocklists and appears in 23 threat intelligence pulses on AlienVault OTX, with a Gridinsoft trust score of 31/100, reflecting significant negative reputation. Current HTTP responses show a 403 status, though earlier observations recorded a 504 gateway timeout, suggesting intermittent availability or deliberate evasion tactics. Twelve security vendors on VirusTotal detect the domain as malicious, though the specific phishing kit or targeted brand remains unconfirmed due to lack of page content analysis. The domain is actively blocked by PhishDestroy, MetaMask, and SEAL, indicating recognition as a threat across multiple security layers. Defenders should treat this domain as hostile infrastructure. The use of Cloudflare and HTTP/3 may complicate takedown efforts and detection, while the Let's Encrypt certificate enables encrypted connections that could mask malicious payloads. No legitimate use case has been observed, and the domain's creation timeline aligns with typical phishing campaign lifecycles. Network-level blocking of 104.21.33.223 and monitoring for connections to app-nado.xyz are recommended until the domain is fully sinkholed or suspended.