apptoolkit[.]site

The domain apptoolkit.site was registered on 21 February 2026 and is currently taken offline. Infrastructure analysis shows it resolves to the IP address 195.35.15.219, which belongs to AS47583 Hostinger International Limited and is geolocated in the United States. The site presented a page titled “launch – launchdag”, a title that does not directly reference the impersonated brand but aligns with the observed wallet/seed phishing kit. The campaign is classified as brand impersonation targeting the brand “across”, and the underlying scam type is identified as wallet or seed phishing, suggesting attempts to harvest cryptocurrency recovery phrases or private keys.

Detection evidence indicates that one of ninety‑three VirusTotal scanners flagged the domain, and four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—have listed it as malicious. The SSL certificate is rated “R11”, indicating a low trust score. The elevated risk rating reflects the combination of brand impersonation and credential‑harvesting intent.

Defenders should immediately add apptoolkit.site and its resolved IP 195.35.15.219 to outbound and inbound block lists, monitor DNS queries for the domain, and inspect any traffic that may have reached the host before takedown. Because the site employed a wallet/seed phishing kit, organizations handling cryptocurrency assets should enforce strict controls on seed phrase entry and educate users about unsolicited prompts to “launch” a wallet. Continuous threat‑intel feeds should be consulted for any re‑use of the same hosting provider or certificate profile, as adversaries often recycle infrastructure after takedown.