turtle-app[.]xyz

On 23 July 2026 the domain turtle-app.xyz was observed in an elevated‑risk brand‑impersonation campaign targeting the generic “across” brand. The domain was registered on 18 October 2025 through NiceNIC International Group Co., Limited and is currently hosted on Cloudflare infrastructure (ASN 13335). DNS resolution returns the IPv6 address 2606:4700:3036::ac43:8842, which maps to a United States location. Both authoritative nameservers—brady.ns.cloudflare.com and paige.ns.cloudflare.com—are Cloudflare‑provided, indicating the attacker leveraged the provider’s CDN and DNS services to obscure origin. No TLS certificate is presented; the site is reachable only over HTTP and, as of the report date, the host is offline.

Threat intelligence flags the site as a wallet/seed phishing operation. The page title retrieved from the site reads “$TURTLE Checker | Turtle”, suggesting the attacker may be attempting to harvest cryptocurrency wallet seeds. Gridinsoft assigns a trust score of 0 / 100, and the domain is listed on a single security blocklist. PhishDestroy has actively blocked the domain, and VirusTotal reports that 12 of 95 scanned security vendors flag the domain as malicious. The limited number of detections may reflect the short time the site has been live.

Defenders should add turtle-app.xyz to network‑level deny lists and ensure DNS filtering solutions block resolution of its IPv6 address. Monitoring of Cloudflare‑associated IP ranges for similar impersonation patterns is advised. Because the site currently returns no SSL certificate and is offline, any future re‑activation would likely involve the same infrastructure; continuous watch‑list updates and correlation with other “across”‑related phishing indicators will improve detection. Until further content analysis is available, the lack of additional visible artifacts remains the primary uncertainty.