apps-merchant[.]xyz

The domain apps-merchant.xyz is currently active and classified as a credential phishing site. It was registered on April 29, 2026 through Dynadot LLC and resolves to the Cloudflare‑protected IP address 188.114.97.3, using the nameservers elle.ns.cloudflare.com and yoxall.ns.cloudflare.com. The site presents an HTTP 403 status and serves a page titled "Just a moment..." under a valid Let's Encrypt certificate (E7). VirusTotal scans show three of ninety‑one security vendors flagging the domain, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on three external blocklists, has been referenced in a single AlienVault OTX pulse, and is blocked by PhishDestroy, MetaMask, and SEAL. Risk rating is high. While the content behind the title has not been publicly examined, the observed infrastructure—recent registration, Cloudflare hosting, low trust score, and multiple detections—indicates a purposeful phishing operation. Defenders should block the domain at network perimeters, monitor DNS queries for the associated IP and nameservers, and consider sinkholing the IP range if feasible. Ongoing telemetry collection is advised to detect any shift in payload delivery or target branding, as current evidence does not reveal the specific credential collection mechanism employed.