transaction-user-api[.]top

Analysis of transaction-user-api.top shows the domain was registered on February 21, 2026 and currently resolves to the IP address 15.197.253.240. The host resides in the United States and is advertised as part of Amazon.com, Inc. (AS16509). The authoritative nameservers are ns1.eranet-dns.com and ns2.eranet-dns.com. The site was scanned by VirusTotal, where 95 independent security vendors examined the domain and returned no detections; the lack of alerts does not constitute a safety guarantee.

The domain appears on a single publicly‑available blocklist and is actively blocked by PhishDestroy, indicating that at least one anti‑phishing feed has identified it as malicious. TLS information shows the site presents an SSL certificate identified as "R11", confirming that encrypted HTTPS was enabled at the time of observation. The current operational status is offline, suggesting the hosting has been taken down or the site is no longer serving content.

Uncertainties remain regarding the specific content that was served before takedown, as no page title, brand targeting, or payload details have been disclosed. Defenders should continue to block traffic to 15.197.253.240 and to the domain name itself, enforce outbound DNS filtering for the listed nameservers, and monitor for any re‑registration or similar credential‑harvesting infrastructure that may reuse the same hosting provider or certificate pattern. Additional threat‑intel sources should be consulted for any emerging indicators related to this infrastructure, and incident response teams should treat any credentials or session data associated with this domain as compromised until proven otherwise.