appildo[.]xyz

appildo.xyz is a newly registered domain created on May 12, 2026 and hosted behind Cloudflare’s network (IP 188.114.96.3, location Canada). The authoritative nameservers are ligia.ns.cloudflare.com and ryan.ns.cloudflare.com, indicating the domain is fully managed through Cloudflare’s DNS service. The site presents an HTTPS certificate issued by Let’s Encrypt (entity E7) but currently returns HTTP 525 – Cloudflare SSL handshake error, suggesting misconfiguration or intentional disruption of normal traffic. The page title observed during probing is “Echo Shift v2”, a label that does not correspond to any known legitimate service and is typical of lure pages used in credential‑harvesting campaigns.

Threat intelligence sources corroborate malicious activity. The domain appears in a single AlienVault OTX pulse and is listed on three external blocklists, including PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows six of ninety‑five security vendors flag the domain, while Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the low confidence in its legitimacy. The combination of a recent creation date, Cloudflare‑only hosting, a mismatched page title, and multiple blocklist entries aligns with the pattern of generic phishing operations that aim to impersonate trusted services.

Defenders should immediately block appildo.xyz at the network perimeter and incorporate it into endpoint and email filtering policies. Continuous monitoring of DNS queries for the associated Cloudflare IP and the two nameservers is advised, as any shift to additional infrastructure may indicate campaign expansion. Incident response teams should treat any credential submissions to “Echo Shift v2” as compromised and enforce credential reset procedures for affected users. Ongoing threat‑intel feeds should be consulted for new indicators, and any future sightings of the domain or its IP should be escalated as high‑risk phishing activity.