app-piggybank[.]xyz

The domain app-piggybank.xyz was registered on March 13 2026 through Dynadot LLC and is presently flagged as a high-risk banking phishing site. The site is still reachable and presents a 504 Gateway time-out page title, indicating an attempt to mask its backend activity while remaining operational.

Infrastructure analysis shows the domain resolves to IP 104.21.41.95, which belongs to the Cloudflare network (AS13335) located in the United States. The authoritative nameservers fred.ns.cloudflare.com and kami.ns.cloudflare.com confirm that the domain is fully proxied through Cloudflare, leveraging HTTP/3 protocol support and a Let’s Encrypt certificate (issuer E8). The use of Cloudflare’s edge services is consistent with attempts to obscure origin infrastructure and to benefit from built‑in DDoS mitigation.

Threat intelligence indicates the domain is listed on three public blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis reports that 2 of 95 security scanners flagged the domain, and Gridinsoft assigns a trust score of 0 out of 100. HTTP requests return a 403 status, suggesting that the site is restricting access to certain clients while still serving malicious payloads to targeted browsers. The combination of a low trust score, blocklist presence, and partial VT detections provides concrete evidence of malicious intent.

Defenders should add app-piggybank.xyz to network and endpoint blocklists, monitor DNS queries for the domain and its associated Cloudflare nameservers, and enforce TLS inspection to detect any credential harvesting attempts. Users should be warned about the banking phishing nature of the site, and any observed login attempts to legitimate financial services originating from this domain should be treated as compromised. Continuous monitoring of the IP address 104.21.41.95 for anomalous traffic is also recommended.