app-heurist[.]xyz

This domain, app-heurist.xyz, is flagged as a cryptocurrency wallet phishing site designed to harvest wallet credentials and private keys. Analysis indicates the infrastructure was likely deployed to mimic legitimate wallet interfaces, a common tactic in cryptocurrency phishing campaigns. No specific brand impersonation or drainer kit signatures were identified in the available data, but the domain’s structure and timing align with known wallet credential theft operations. Infrastructure analysis reveals the domain was registered on March 13, 2026, through Dynadot LLC and resolves to the IP address 188.114.97.3, which is associated with Cloudflare services. The domain is detected by 15 out of 95 security vendors on VirusTotal, with three independent security blocklists listing it as malicious. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites due to its accessibility. No Google Safe Browsing (GSB) status is available, but the domain’s inclusion on multiple blocklists suggests prior active malicious use. The domain is currently offline, returning a 504 Gateway Time-out error, indicating either a takedown or voluntary deactivation by the threat actor. Despite its offline status, the domain remains a residual risk due to its recent creation date, blocklist presence, and historical malicious activity. Organizations and individuals are advised to maintain blocklist entries for this domain, monitor for re-registration or DNS reactivation, and conduct retrospective analysis of logs for prior connections. Users who interacted with the domain should assume credential compromise and rotate any exposed wallet keys or authentication tokens.