auxnest[.]com

The domain auxnest.com is currently offline, having been taken down after detection of malicious activity. Registration records show the domain was created on 25 December 2025 through NameSilo, LLC, and it is served by the authoritative nameservers dns3.afeeshost.com, ns41.afeeshost.com, and ns42.afeeshost.com. The public page title associated with the domain reads “auxnest.com The Global Crypto Investors,” which does not contain any reference to the targeted brand. However, intelligence flags the site as a brand‑impersonation campaign targeting Amazon, indicating that the actors intended to misuse the Amazon brand in their lure. Infrastructure analysis reveals that auxnest.com resolves to the IPv4 address 92.204.41.13, which is allocated to AS29066 (velia.net Internetdienste GmbH) in France.

No TLS certificate is present for the host, meaning connections would be unencrypted. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service. VirusTotal scanning shows three out of ninety‑three anti‑malware engines flag the domain as malicious, reinforcing the suspicion of abuse. The Gridinsoft trust score of zero out of one hundred further corroborates the hostile nature of the infrastructure. No evidence of a safe‑browsing verdict or Open Threat Exchange entry is available, and the lack of an SSL certificate suggests the site was not intended for legitimate user interaction.

The combination of a recent creation date, a low‑reputation IP address, minimal detection coverage, and specific brand‑impersonation labeling points to a short‑lived phishing or credential‑harvesting operation. Defenders should continue to block auxnest.com at perimeter filters and proxy solutions, monitor the associated IP range for any resurgence, and add the domain to internal blacklists. Incident response teams handling Amazon‑related credential compromise should consider auxnest.com as a potential source of malicious emails or redirects.