apriori-live[.]xyz

The domain apriori-live.xyz was registered through NiceNIC International Group Co., Limited and first appeared in the DNS on October 26, 2025. It is hosted on the IPv4 address 195.26.87.207, which IP‑whois attributes to the Netherlands (AS43641 SOLLUTIUM EU Sp z.o.o.). The authoritative nameservers are ns1-ams.v-sys.org and ns2-ams.v-sys.org. No TLS certificate is presented for the site, indicating that the service operates without HTTPS encryption.

When accessed, the HTTP response returned the page title “Account Suspended,” which aligns with the classified scam type of Account Takeover. The domain has been observed on two public blocklists and is actively blocked by the PhishDestroy and ScamSniffer filtering services. VirusTotal analysis shows that nine of the ninety‑five scanned security vendors flagged the domain as malicious, reinforcing the suspicion of phishing activity. As of the report date, July 25, 2026, the domain is listed as taken offline, suggesting that the malicious infrastructure may have been disrupted or is temporarily inactive.

However, the underlying hosting infrastructure and registrar details remain unchanged, meaning that the threat actor could reactivate the domain or replicate the campaign on similar infrastructure. Defenders should continue to monitor the IP address 195.26.87.207 and the associated ASN for any reappearance of malicious traffic, enforce blocklist updates to include apriori-live.xyz, and consider adding the domain to internal deny lists. Additional scrutiny of traffic to the hosting provider’s name servers may reveal further compromised assets. Until further activity is observed, the risk rating remains elevated due to the confirmed account‑takeover intent and the presence of multiple security vendor detections.