maxapk[.]xyz

Analysis indicates that the domain maxapk.xyz is currently active and associated with a generic phishing campaign classified as elevated risk. The domain was registered through NameCheap, Inc. on 30 March 2025 and uses the public parking nameservers ns1.park‑my‑domain.net and ns2.park‑my‑domain.net. DNS resolution points to the IPv4 address 75.2.60.5. VirusTotal reports that 14 of 91 scanned security vendors have flagged the domain, demonstrating a moderate level of detection across multiple engines.

The domain appears on a single external blocklist and is explicitly blocked by the PhishDestroy service, confirming that at least one threat‑intelligence feed has taken remediation action. Evidence from the available intelligence does not include a page title, SSL certificate details, HTTP response codes, or any observed brand targeting, so the precise content and lure employed by the site remain uncertain. Likewise, no additional blocklist entries or community reports have been recorded beyond the single listing, limiting the breadth of external corroboration. The lack of further public sightings suggests the campaign may be in an early deployment phase or employing low‑volume distribution.

Defenders should prioritize immediate containment of traffic to maxapk.xyz by adding the domain to network‑level deny lists and configuring endpoint protection to block the associated IP address 75.2.60.5. Continuous monitoring of DNS queries for the listed nameservers and periodic re‑scans on VirusTotal are recommended to capture any evolution in detection scores. Organizations that rely on brand‑specific credential entry should educate users about unsolicited requests that reference unrelated applications, as the domain name does not correspond to a known legitimate service. Ongoing intelligence gathering, including web content retrieval and passive DNS analysis, will be necessary to refine the threat profile as additional artifacts become available.