user-apyx[.]xyz

PhishDestroy identifies user-apyx.xyz as an active credential harvesting domain currently impersonating a generic login portal to steal user credentials. This domain was flagged by PhishDestroy’s automated pipeline under seed 2ad3ea and is categorized as a generic phishing domain designed to harvest login credentials from unsuspecting users. The infrastructure suggests a drainer kit deployment, likely targeting users through phishing emails or social engineering campaigns to capture credentials in real time.

This domain resolves to IP address 185.53.179.128 and was registered through Dynadot LLC on March 30, 2026. VirusTotal currently shows 3/95 detection engines flagging this domain, indicating it is not yet widely recognized as malicious. This low detection rate highlights the stealthy nature of the campaign and the need for proactive monitoring. The domain has not been flagged by Google Safe Browsing (GSB) and remains unlisted on major blocklists, further increasing its potential reach and effectiveness. The combination of a newly created domain, low detection, and absence from blocklists makes this a high-risk phishing vector.

As of the latest assessment, user-apyx.xyz remains active and under investigation. PhishDestroy has flagged this domain for immediate takedown and reputation management. Users are strongly advised to avoid visiting this domain and to report any suspicious emails or messages linked to it. While the domain is not yet widely blocked, organizations should update firewall rules and endpoint protections to include IP 185.53.179.128 and domain user-apyx.xyz. Remaining risk is assessed as high due to low detection and active infrastructure, with potential for rapid expansion if unchecked. Enhanced user awareness and network-level defenses are critical to mitigate exposure.