xyz-app-trade[.]live

Analysis of xyz-app-trade.live indicates that the domain was registered on June 22 2026 through Global Domain Group LLC and is currently resolved to IP 188.114.96.3, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The site presented a page title of “Success!” and was served over TLS using a certificate issued by Google Trust Services under the WE1 intermediate. DNS resolution is handled by josephine.ns.cloudflare.com and will.ns.cloudflare.com, consistent with the Cloudflare hosting profile. Threat intelligence feeds have listed the domain on three security blocklists, and it is explicitly blocked by PhishDestroy, MetaMask, and SEAL.

VirusTotal reports that two of ninety‑one scanned security vendors flagged the domain, reinforcing the suspicion of malicious use. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, indicating a high confidence of abuse. The overall risk rating is elevated, and the current operational status is offline, suggesting that the malicious infrastructure may have been taken down or is temporarily unavailable. While the page title “Success!” provides no direct indication of the targeted brand or credential‑stealing technique, the combination of rapid registration, cloud‑hosted IP, low trust score, blocklist presence, and vendor detections aligns with typical generic phishing deployments.

No additional content analysis has been published, so the exact phishing payload or victim lure remains unknown. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for re‑appearance of the host or related subdomains, and consider adding the IP address 188.114.96.3 to reputation‑based deny lists. Ongoing watch of Cloudflare‑associated malicious domains is advisable, as the hosting provider can be leveraged for rapid re‑deployment.