38536[.]app

PhishDestroy identifies 38536.app as a credential theft domain, currently offline, which had been impersonating various brands to trick users into divulging sensitive information.

This domain was flagged by 6 of 95 VirusTotal vendors, indicating a significant risk to users who may have interacted with it, and was registered through GoDaddy.com, LLC, resolving to the IP address 23.225.45.6, created on June 15, 2026, and appears on 1 security blocklist, further emphasizing its malicious nature, with an SSL certificate issued by Let's Encrypt, specifically YE1, which may have attempted to legitimize the domain's fake claims.

The fact that 38536.app has been taken offline suggests that authorities or the registrar have taken action against it, but users who may have already visited the site should still be cautious and monitor their accounts for any suspicious activity, and consider changing their passwords as a precautionary measure, as the credential theft threat posed by this domain is still a concern, and users should remain vigilant to protect themselves from similar threats in the future.