app[.]turtledote[.]xyz

This report analyzes the domain app.turtledote.xyz, which presents a generic "Nur einen Moment…" (German for "Just a moment…") page title, a common placeholder for phishing or browser-in-the-middle attack frameworks. The site poses a credential theft and malware delivery threat, as it may capture user input or redirect to malicious payloads.

Technical evidence confirms the malicious nature of this domain. VirusTotal shows 8 out of 95 security vendors flagged the site, including ChainPatrol, alphaMountain.ai, CRDF, CyRadar, and Forcepoint ThreatSeeker. Two blocklists list the domain. The domain is hosted on IP 172.67.221.137 (United States), assigned to AS13335 Cloudflare, Inc., with nameservers donna.ns.cloudflare.com and howard.ns.cloudflare.com. The registrar is PDR Ltd. d/b/a PublicDomainRegistry.com, and the domain was created on 2025-10-20. No SSL certificate is present.

The domain is currently offline and inaccessible. ScamAdviser gives it a trust rating of 1 out of 100, indicating high risk. Based on the detection rate, recent creation date, and lack of SSL, this domain is assessed as a high-risk threat, likely part of a phishing campaign, and should be blocked.