95baf[.]laxmus[.]cc

Analysis of the domain 95baf.laxmus.cc, created on 02 March 2026 and currently offline, shows multiple indicators of malicious use. The domain is registered through NiceNIC International Group Co., Limited and resolves to the IPv4 address 217.60.62.75, which belongs to AS56971 Cloud in Finland. The hosting server runs Nginx and presents a Let’s Encrypt R13 certificate, which does not provide any authentication of the operator. The site’s page title is identical to the domain string, offering no additional context.

Reputation services have flagged the domain: PhishDestroy lists it as blocked, Gridinsoft assigns a trust score of 0 out of 100, and it appears on one external blocklist. VirusTotal reports that 12 of 93 scanned security vendors flagged the domain, indicating a consensus of malicious behavior. The domain’s authoritative nameservers are a.dnspod.com and c.dnspod.com, both commonly used by fast‑changing infrastructure. While the exact phishing payload or targeted brand has not been disclosed, the combination of low trust scores, multiple vendor detections, and blocklist inclusion confirms that the domain was employed for phishing.

Defenders should continue to block the domain at network perimeter, update DNS‑based blocklists, and monitor the associated IP address 217.60.62.75 for any resurgence. Additional investigation of traffic logs for connections to the listed nameservers may reveal related campaign infrastructure. Because the site is offline, real‑time verification is not possible, and analysts should rely on the recorded indicators for future detection.