app-extrafi[.]xyz

This domain, app-extrafi.xyz, is flagged as an active phishing gateway operating behind Cloudflare infrastructure. Registered on March 13, 2026, through Dynadot LLC, the domain currently resolves to IP address 188.114.97.3, part of AS13335 (Cloudflare, Inc.) in the United States. Analysis indicates the site is configured with HTTP/3 and is protected by a Google Trust Services SSL certificate (WE1), typical of modern phishing setups leveraging Cloudflare's proxy services. As of July 12, 2026, the domain returns an HTTP 403 status, though earlier observations recorded a 504 Gateway Time-out error, suggesting intermittent availability or backend instability. The page title, 'app-extrafi.xyz | 504: Gateway time-out,' does not reveal specific branding or targeting, and no confirmed brand impersonation has been identified in available data. The domain appears on one security blocklist and is blocked by at least one threat intelligence provider. Infrastructure analysis reveals Cloudflare nameservers (seamus.ns.cloudflare.com and sofia.ns.cloudflare.com), consistent with threat actors using the service to mask origin servers and evade takedowns. While two of 94 security vendors on VirusTotal flagged the domain, this detection rate is not conclusive evidence of malicious activity alone. The Gridinsoft trust score of 0/100 further supports its classification as high-risk. Defenders should treat this domain as an active phishing threat, particularly given its recent registration and use of anonymizing infrastructure. Network-level blocking is recommended, along with monitoring for related domains or IPs within the same Cloudflare ASN. Further investigation into backend hosting and potential victim reports is advised to determine the exact phishing vector, as the current HTTP errors may indicate a temporary disruption rather than a full takedown.