repeg-apyx[.]app

This domain, repeg-apyx.app, is flagged as a generic phishing site specializing in crypto wallet credential theft. Analysis indicates it impersonates the Apyx platform, a known blockchain service, likely deploying a wallet drainer kit to siphon cryptocurrency from victims. The page title explicitly displays 'Apyx,' suggesting a targeted campaign against users of this service. Technologies detected include jsDelivr for payload delivery, crypto-js for cryptographic manipulation, and Cloudflare infrastructure, which is frequently abused to mask malicious activity behind legitimate CDN services. Infrastructure analysis reveals the domain was registered on June 12, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar commonly associated with high-risk domains. It resolves to IP address 172.67.168.184, hosted behind Cloudflare, which complicates attribution and takedown efforts. VirusTotal detection shows 2 out of 95 security vendors flagging the domain, while Gridinsoft assigns a trust score of 0/100. The domain appears on 3 security blocklists, including MetaMask and PhishDestroy, which specifically target crypto-related phishing threats. The SSL certificate is issued by Google Trust Services, providing a false sense of security to potential victims. The domain is currently offline, likely due to takedown actions or abandonment by the threat actor. However, the risk remains elevated for users who may have interacted with the site prior to its deactivation. Historical DNS records and cached pages may still pose a threat if accessed. Users are advised to revoke any wallet permissions granted during potential interactions with this domain, monitor connected accounts for unauthorized transactions, and verify all future communications through official Apyx channels. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.