app[.]baevux[.]com

The domain app.baevux.com was registered on July 31 2026 and is presently active. Its authoritative nameservers are donald.ns.cloudflare.com and eva.ns.cloudflare.com, indicating use of Cloudflare DNS services. The registrar entry lists Fewmoretaps OU d/b/a Trustname.com as the sponsoring organization. DNS resolution points to the IPv4 address 188.114.97.3, an IP that is already listed on a security blocklist and has been flagged by the PhishDestroy sinkhole.

VirusTotal analysis shows that six of ninety‑one scanning engines have raised detections against the domain, confirming malicious behavior despite a relatively low overall detection ratio. The domain appears on one external blocklist, reinforcing the view that it is being used for illicit purposes. No public SSL certificate details, HTTP response codes, or page‑title information are currently available, so the exact content served by the host remains unknown. Likewise, Safe Browsing, Open Threat Exchange, and other reputation services have not been referenced in the supplied intelligence, leaving a gap in the broader threat‑intel picture.

Defenders should add app.baevux.com to local and network‑level deny lists, monitor DNS queries for the associated Cloudflare nameservers, and consider blocking outbound connections to 188.114.97.3 at the firewall. Given the recent creation date and the early detection by multiple vendors, the domain should be treated as high‑risk until further forensic analysis confirms its activity. Continuous observation of any new detections, changes in blocklist status, or emergence of SSL/TLS artifacts is recommended to adjust remediation actions promptly.