app[.]turtledot[.]xyz

Analysis of app.turtledot.xyz shows a short‑lived domain that was created on 16 Oct 2025 and is currently taken offline. The site served a page whose only visible element was the title “Just a moment…”, indicating no legitimate content was delivered before takedown. The domain resolves to the Cloudflare‑managed address 104.21.86.4, located in the United States under ASN 13335 (Cloudflare, Inc.). No SSL certificate is associated with the host, so any attempted HTTPS connections would fail or be downgraded to HTTP, a typical characteristic of hastily deployed phishing infrastructure.

The registrar listed is PDR Ltd. d/b/a PublicDomainRegistry.com, and the authoritative nameservers are heidi.ns.cloudflare.com and jay.ns.cloudflare.com, both Cloudflare‑provided. Reputation signals are uniformly negative: Scamadviser assigns a trust score of 1 / 100, and the domain appears on a single security blocklist where it has been flagged by PhishDestroy. VirusTotal scans report that seven of ninety‑five security vendors flagged the domain, providing independent confirmation of malicious intent. The limited detection footprint suggests the site was active for a brief window before removal, which aligns with the elevated risk rating.

Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of the same IP or related Cloudflare‑hosted subdomains, and update any URL filtering policies to include the observed host. Because the page content was not captured beyond the title, further forensic analysis of request logs is recommended to determine whether credential‑stealing forms or redirects were ever served. The lack of SSL and the rapid takedown indicate a low‑cost, opportunistic phishing operation; however, the presence on a phishing‑specific blocklist and multiple vendor detections warrant maintaining the current elevated risk posture until the domain is fully retired from threat intelligence feeds.