repeg-apyxfi[.]app

PhishDestroy identifies repeg-apyxfi.app as an active credential harvesting phishing domain currently under investigation. This threat specifically aims to deceive users into submitting login credentials, financial details, or other sensitive information through fraudulent login portals or fake authentication prompts. The domain remains unflagged by security vendors, posing a heightened risk to unsuspecting victims. This domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 104.21.57.191. As of the latest scan, VirusTotal reports 2 out of 95 security vendors detecting malicious activity, indicating the domain has not yet been widely recognized as a threat. The SSL certificate is issued by Google Trust Services (WE1), which may lend a false sense of legitimacy to users. No blocklist entries or trust score downgrades have been recorded, and the domain remains fully operational. To mitigate risks associated with credential harvesting phishing, users and organizations should implement multi-factor authentication (MFA) on all accounts to reduce the impact of stolen credentials. Security teams are advised to block the domain repeg-apyxfi.app and its resolving IP 104.21.57.191 at the firewall or DNS level. End-users should be trained to scrutinize URLs, avoid clicking on unsolicited links, and verify the legitimacy of login pages before entering credentials. Monitoring for unusual authentication attempts or failed login patterns can help detect compromised accounts early.