axos[.]co[.]com

The domain axos.co.com was identified as a phishing resource targeting users of Axos Bank, a financial services institution. Analysis confirms this domain operated as a generic phishing site designed to harvest login credentials, account details, or other sensitive financial information. As of the latest verification, the domain has been taken offline, though prior activity suggests it was actively used in fraudulent campaigns. Infrastructure analysis reveals the domain resolved to the IP address 104.21.93.83, a Cloudflare-hosted endpoint. Detection metrics indicate that 2 of 95 security vendors on VirusTotal flagged the domain as malicious, while it appeared on at least one security blocklist. The domain was registered through Moniker Online Services LLC, a registrar frequently associated with high-risk domains. Additional technical indicators include the use of Cloudflare Browser Insights and HTTP/3, suggesting an attempt to leverage modern web technologies to evade detection or improve performance. The page title returned a 404 Not Found error, which may indicate either a takedown or a deliberate attempt to obscure its malicious purpose. Current status confirms the domain is offline, reducing immediate risk to end users. However, the infrastructure and registration patterns observed warrant continued monitoring. Organizations and individuals are advised to block the domain and its associated IP address (104.21.93.83) at the network level. Financial institutions should alert customers to verify URLs carefully, particularly those resembling legitimate banking domains. Security teams are encouraged to review logs for connections to this domain or IP, as prior interactions may indicate compromised credentials or ongoing fraud attempts. Proactive measures, such as implementing multi-factor authentication and domain-based email filtering, are recommended to mitigate similar threats.