v1-aavdex[.]sbs

The domain v1-aavdex.sbs has been identified as a brand impersonation threat specifically targeting X.com. This domain was created on December 5, 2025, and is part of a coordinated attempt to deceive users by mimicking the appearance and functionality of the legitimate X platform. The page title observed was simply "Welcome to nginx!" which often indicates a placeholder or initial setup page for phishing infrastructure. Although the site is currently offline, the domain remains a significant risk due to its association with credential harvesting and potential malware delivery.

Technical analysis reveals that v1-aavdex.sbs resolves to the IP address 172.67.134.158 and was registered through NiceNIC International Group Co., Limited. VirusTotal reports that 9 out of 95 security vendors flag this domain as malicious, and it appears on at least one security blocklist. The SSL certificate was issued by Google Trust Services (WE1), which is typical for Cloudflare-protected sites. The domain was registered only recently, in December 2025, which is a common red flag for phishing campaigns. Google Safe Browsing status was not explicitly provided but the high vendor flagging suggests it is likely blocked by major browsers.

The domain has been taken offline, which may be due to takedown actions by the hosting provider or registrar. However, users should remain vigilant as the operators may re-register similar domains or launch new campaigns. PhishDestroy recommends blocking v1-aavdex.sbs at the network level, monitoring for related domains using the seed "3af153", and educating users to verify URLs before entering credentials. If any user has visited this domain, they should change their X.com password and enable two-factor authentication immediately.