app-apyxfi[.]com

Analysis indicates that the domain app-apyxfi.com is actively hosting a crypto‑related phishing campaign. The site returns an HTTP 301 response and presents the page title “Apyx”. Registration data shows it was created on 9 June 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. DNS resolves to 172.67.189.170, an address operated by Cloudflare, Inc., with the IP geolocated to Canada. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming a valid HTTPS endpoint. Automated scanning by ninety‑one security engines recorded detections from two of them, and the domain appears on three public blocklists. It is referenced in two threat‑intelligence pulses and has been blocked by three anti‑phishing filters. Infrastructure analysis reveals the presence of third‑party libraries jsDelivr and crypto‑js, as well as Cloudflare Browser Insights and HTTP/3 support, which are commonly used to deliver malicious JavaScript payloads. The reported trust score is 0/100, indicating a high confidence of malicious intent. The classification in the intelligence set is “Crypto Scam”, and the risk rating is high. While the exact content of the landing page has not been observed, the combination of a recent registration, use of a reputable CDN service, low trust score, multiple detections, and inclusion on anti‑phishing blocklists strongly suggests a credential‑harvesting or crypto‑draining operation. Defenders should block network connections to the domain, add it to DNS blacklists, and monitor for any traffic to the associated IP address. Continuous re‑scanning is recommended to capture any changes in the payload or detection status.