app-iex[.]xyz

app-iex.xyz was registered on 13 March 2026 through Dynadot LLC. The domain is associated with a generic phishing campaign and is currently flagged as high‑risk. Infrastructure analysis shows the zone is delegated to Cloudflare nameservers (conrad.ns.cloudflare.com, pam.ns.cloudflare.com) and the site is served behind Cloudflare’s network (ASN 13335, United States). The TLS certificate is issued by Let’s Encrypt (E7), confirming the use of a publicly‑available certificate for encrypted connections.

The web service returns HTTP 403 responses, while the observed page title reports a “504: Gateway time‑out” condition, indicating intermittent availability or intentional throttling. The site resolves to 104.21.70.137, an IP address owned by Cloudflare and supporting HTTP/3, which is consistent with the observed use of modern transport protocols. No additional hosting details are disclosed beyond the Cloudflare edge.

Reputation data shows the domain is listed on three security blocklists and has a Gridinsoft trust score of 0 out of 100. VirusTotal scans have flagged the domain by one out of 95 security vendors, and the domain is actively blocked by PhishDestroy, MetaMask, and SEAL. These indicators collectively confirm that the domain is being used for malicious phishing activity, though the low number of VirusTotal detections suggests limited exposure or recent deployment.

Defenders should treat app‑iex.xyz as a confirmed phishing source. Immediate actions include adding the domain to network and email deny lists, configuring DNS filtering to block resolution, and monitoring outbound traffic for connections to 104.21.70.137. Continuous threat‑intel feeds should be consulted for any new indicators, and any compromised credentials reported by users should be reset. Given the active Cloudflare front‑end, consider using sinkholing or proxy inspection to capture payloads if the domain is accessed.