app-tpxauusd[.]com

Analysis of the domain app-tpxauusd.com indicates it is an active credential-phishing site, first registered on June 15, 2026, through the registrar Gname.com Pte. Ltd. The domain currently resolves to the IP address 43.247.132.5 and is supported by nameservers a.share-dns.com, a12.share-dns.com, b.share-dns.net, and b12.share-dns.net. As of July 17, 2026, the domain remains operational and has been flagged by Google Safe Browsing for social engineering activity. Three out of ninety-one security vendors on VirusTotal have identified the domain as malicious, though the specific nature of the phishing content has not yet been fully analyzed. Infrastructure analysis reveals that the domain shares nameserver infrastructure with other high-risk domains, suggesting potential coordination within a broader phishing campaign. The registrar, Gname.com Pte. Ltd., has been previously associated with domains involved in fraudulent activity, though no direct attribution to a specific threat actor or group is currently available. The domain was also identified in one AlienVault OTX threat intelligence pulse, further corroborating its malicious classification. Defenders are advised to block the domain and its resolving IP address at the network level. Organizations should monitor for any connections to 43.247.132.5 or the listed nameservers, as these may indicate compromised endpoints attempting to communicate with the phishing infrastructure. Given the domain's recent registration and active status, continued monitoring for related domains using the same registrar or nameserver infrastructure is recommended. The exact brand or service being impersonated remains unconfirmed, and further analysis of the site's content is required to determine the specific phishing lure.