app[.]getgenius[.]xyz

This domain, app.getgenius.xyz, is identified as a credential harvesting phishing site designed to deceive users into submitting login credentials. The site mimics legitimate authentication pages, tricking visitors into entering sensitive information such as usernames, passwords, or multi-factor authentication codes. Once submitted, this data is transmitted to threat actors, enabling unauthorized access to accounts, financial theft, or further exploitation through lateral movement in compromised systems. Analysis indicates the domain was registered on March 29, 2026, through Namecheap, a registrar frequently abused for malicious infrastructure. At the time of assessment, 4 out of 95 security vendors on VirusTotal flagged the domain as malicious, confirming its association with phishing activity. The site resolves to the IP address 188.114.97.3 and employs a Let's Encrypt SSL certificate, which provides encryption but does not validate legitimacy. Additional technical indicators include the use of Cloudflare and Cloudflare Browser Insights, technologies often leveraged to obfuscate malicious infrastructure and evade detection. If you visited app.getgenius.xyz and entered credentials, immediate action is required to mitigate risk. First, change passwords for any accounts accessed or entered on the site, prioritizing email, financial, and work-related platforms. Enable multi-factor authentication (MFA) where available, using app-based or hardware tokens instead of SMS. Monitor accounts for unauthorized transactions, password reset attempts, or suspicious login activity. If financial or corporate credentials were exposed, notify the respective institution or IT security team. Consider revoking active sessions on compromised accounts and scanning devices for malware, as phishing sites may also deliver malicious payloads. Report the domain to security teams or threat intelligence platforms to aid in broader detection and takedown efforts.