app[.]poiyhedra[.]click

The domain app.poiyhedra.click is a phishing site that has been flagged by one out of 94 vendors on VirusTotal. Despite its current offline status, it was previously hosted on an IP address managed by CloudFlare in Canada. The domain utilized Let's Encrypt for its SSL certification, a common tactic among phishing sites to appear legitimate.

Registered through Dynadot, LLC, app.poiyhedra.click was created on April 24, 2026. It quickly made its way onto public blocklists, including PhishDestroy's, indicating its malicious intent. The use of CloudFlare's infrastructure is a typical choice for phishing operations, providing a layer of anonymity and resilience against takedown efforts.

Phishing domains like app.poiyhedra.click exploit the window between their registration and detection by antivirus databases. This domain's presence on only one public blocklist and minimal VirusTotal detections highlight its relative freshness at the time of analysis. Such domains aim to deceive users by mimicking legitimate services, often using SSL certificates from Let's Encrypt to enhance credibility.

While app.poiyhedra.click is currently offline, its brief activity underscores the need for continuous monitoring and rapid response to emerging threats. The swift action by PhishDestroy and its inclusion on blocklists demonstrate effective threat intelligence operations, crucial for mitigating the risks posed by such phishing domains.