web[.]aplfinance[.]us

The domain web.aplfinance.us was registered on January 14, 2025 through the registrar 1API GmbH and is currently hosted on Cloudflare infrastructure (AS13335) with the IP address 172.67.213.215 located in the United States. The domain resolves to two Cloudflare nameservers, jimmy.ns.cloudflare.com and sydney.ns.cloudflare.com, and does not present an SSL certificate, indicating an unencrypted HTTP service at the time of analysis. Gridinsoft assigned a trust score of 0 out of 100, reflecting a lack of reputation. VirusTotal recorded a single positive detection among 95 security vendor scans, confirming that at least one vendor flagged the site as malicious.

The domain appears on one security blocklist and has been blocked by the PhishDestroy anti‑phishing service. The page title returned from the site is "APL", and the campaign is classified as credential phishing, impersonating the brand "across". The site has been taken offline, and no further content is presently accessible for deeper content inspection. Defenders should note the specific indicators of compromise: the domain name, registration date, registrar, the Cloudflare IP 172.67.213.215, the lack of TLS, the low Gridinsoft score, and the single vendor detection on VirusTotal.

Network defenses should block outbound connections to the IP address and enforce DNS filtering for the domain. Endpoint protection should monitor for credential‑theft activity tied to the "across" brand and consider adding the domain to internal blocklists. Continuous monitoring of Cloudflare‑hosted IP ranges for similar patterns is advised, as the infrastructure can be reused for future impersonation campaigns.