app-plazaflnance[.]xyz

Analysis shows that the domain app-plazaflnance.xyz was registered on February 21, 2026 and is presently taken offline. DNS resolution points to the IP address 172.67.128.184, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The infrastructure has been listed on five independent security blocklists, specifically PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura, indicating that multiple downstream filters have identified it as malicious. VirusTotal scans recorded two positive detections out of ninety‑three security vendors, reinforcing the suspicion of abusive use.

The domain presents an SSL certificate identified as WE1, but no further certificate details are disclosed. No page title, brand reference, or additional content has been observed, and the HTTP status is not currently reachable due to the offline state. Evidence therefore confirms that the domain has been leveraged for credential harvesting activities, consistent with the generic phishing classification.

Uncertainty remains regarding the exact phishing kit, target brands, or the specific payload delivered, as no page‑level analysis is available. Defenders should continue to block the domain and its associated IP address, monitor for any re‑appearance of the host on their networks, and update intrusion detection signatures to include the listed blocklist identifiers. Ongoing surveillance of Cloudflare‑hosted IP ranges for similar patterns is recommended, as well as periodic re‑query of VirusTotal and other reputation services for any new detections.