app-spectreai[.]xyz

app‑spectreai.xyz was first observed on March 13 2026 and is currently listed as active. Multiple intelligence sources have classified the site as a generic phishing operation, and it carries a high risk rating. The domain resolves to 104.21.73.15, which belongs to AS13335 operated by Cloudflare, Inc. The registration was performed through Dynadot LLC and uses the nameservers evan.ns.cloudflare.com and joselyn.ns.cloudflare.com. An SSL certificate issued by Let’s Encrypt (certificate identifier E7) secures the HTTPS service.

Infrastructure analysis shows the site is protected by Cloudflare and serves HTTP/3 traffic. A direct HTTP request returns a 403 status code, while the page title displayed in the browser indicates a 504 Gateway time‑out error, suggesting the backend server is unavailable or deliberately concealed. The domain has a Gridinsoft trust score of 0 out of 100 and appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL.

Threat intelligence feeds report that only one of ninety‑five VirusTotal scanners flagged the domain, reflecting limited detection coverage but not eliminating malicious intent. The low trust score, blocklist presence, and the explicit classification as generic phishing provide concrete evidence of abuse. No additional malware payloads or credential‑stealing kits have been observed, leaving the exact phishing content and target audience uncertain.

Defenders should immediately block all traffic to app‑spectreai.xyz at the DNS or firewall level and monitor for any outbound connections to its IP address. Continuous observation of the domain’s certificate renewal and any changes to its HTTP response codes is advised, as shifts may indicate the activation of a live phishing page. Organizations should also update email filters to flag URLs containing “spectreai.xyz” and educate users about potential credential‑harvesting attempts linked to this domain.