axa-mont-terrible[.]ch

The domain axa-mont-terrible.ch was observed as a generic phishing site that has been taken offline as of the report date, July 23, 2026. Infrastructure analysis shows that the domain resolved to the IPv6 address 2001:1600:4:b:3673:5aff:fea4:a5ec, which is hosted by Infomaniak Network SA in Switzerland (AS29222). The authoritative name servers are ns41.infomaniak.com and ns42.infomaniak.com, indicating that the domain was registered with a provider that also hosts legitimate services. No TLS certificate was detected for the site, suggesting that the service was delivered over plain HTTP.

The page title returned by the server was "Agence Principale Porrentruy", but no further content has been captured, leaving the exact impersonated brand or service ambiguous. Threat intelligence records show that the domain appeared in two AlienVault OTX pulses and is listed on one public security blocklist. It was also blocked by the PhishDestroy service. Reputation scoring from Gridinsoft assigned a score of 0 out of 100, reflecting an extremely low trust rating.

VirusTotal analysis flagged the domain in 15 of 93 security vendor scans, providing additional confirmation of malicious intent. Given the limited visibility into the payload, the primary indicators of compromise are the IPv6 host, the lack of encryption, and the multiple detections across independent platforms. Defenders should add the domain and its associated IPv6 address to blocklists, monitor the AS29222 range for similar activity, and consider sinkholing any future resolutions. Continuous observation of the Infomaniak name servers for new suspicious entries is advised, as is periodic re‑evaluation of the domain should it become active again.