axaxaxaxaxxaaxxxaxa[.]xyz

Analysis of axaxaxaxaxxaaxxxaxa.xyz on July 24, 2026 indicates a high‑risk brand‑impersonation campaign targeting the x.com brand. The domain was registered on October 30, 2025 through Web Commerce Communications Limited and resolves to 172.67.207.28, an IP address owned by AS13335 Cloudflare, Inc. in the United States. Cloudflare nameservers terin.ns.cloudflare.com and venus.ns.cloudflare.com are authoritative, and the site delivers content over HTTP/3 using Cloudflare Browser Insights. The server presents a generic "Welcome to nginx!" title and returns an HTTP 301 redirect, suggesting no further page content has been captured.

An SSL certificate issued by Google Trust Services (WE1) is present, providing encryption but not authentication of the underlying site owner. Reputation data shows a Gridinsoft trust score of 0 / 100 and the domain appears on a single security blocklist, with PhishDestroy confirming it as blocked. VirusTotal reports three detections out of ninety‑three scanners, reinforcing the malicious assessment.

The overall threat posture is active, with the domain currently listed as a brand‑impersonation scam. Defenders should route traffic to this domain to a deny list, incorporate it into URL filtering policies, and monitor for any future changes in page content or additional detections. Continuous re‑evaluation is advised because the public page content is limited to the default nginx title, leaving the exact payload or phishing infrastructure unknown at this time.