app-extended[.]xyz

Analysis of the domain app-extended.xyz, observed on July 24, 2026, indicates that the site is engaged in a confirmed phishing operation. The domain resolves to IP address 188.114.96.3, which is owned by AS13335 Cloudflare, Inc. and geolocated in the United States. Hosting is provided through Cloudflare with HTTP/3 enabled, and the TLS certificate is issued by Let’s Encrypt under the identifier E8, reflecting a valid but generic encryption layer. The domain was registered through Dynadot LLC on March 03, 2026 and is delegated to the authoritative nameservers alexa.ns.cloudflare.com and randall.ns.cloudflare.com.

The site currently returns a 504 Gateway timeout page title, indicating that the service is offline at the time of observation, yet the infrastructure remains in place. Security telemetry shows that four of ninety‑four VirusTotal scanners have flagged the domain, and it appears on three external blocklists. Additionally, the domain is explicitly blocked by PhishDestroy, MetaMask, and SEAL, and it has received a Gridinsoft trust score of zero out of one hundred, underscoring its malicious reputation.

While the exact phishing payload or targeted brand is not disclosed in the available data, the convergence of Cloudflare‑based hosting, low trust scoring, and multiple blocklist entries provides sufficient confidence to classify the domain as a phishing vector. Defenders should add app-extended.xyz to URL filtering and DNS sink‑hole policies, monitor for any re‑activation of the host, and consider sharing the indicator with upstream threat‑sharing platforms. Continuous verification of the domain’s status is advised, as the current offline state may be temporary and could be re‑leveraged for future phishing campaigns.