axiomsniffer[.]xyz

Analysis indicates that the domain axiomsniffer.xyz was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (AS13335) with the IP address 104.21.11.233 located in the United States. The authoritative nameservers are carter.ns.cloudflare.com and susan.ns.cloudflare.com, and the site presented an SSL certificate issued by Google Trust Services under the WE1 label, confirming the use of a valid TLS chain. The page title returned by the server is “Axiom”. VirusTotal scans have recorded five positive detections out of ninety‑three submitted engines, and the domain appears on three public blocklists.

Independent blocking services PhishDestroy, MetaMask, and SEAL have also listed the domain as malicious. Gridinsoft assigned a trust score of zero out of one hundred, reflecting a high confidence of abuse. The site is currently offline, and no active HTTP response was observed at the time of analysis. Evidence suggests that the domain is being used for a generic phishing campaign, although the specific target or lure has not been disclosed in the available data.

The presence of multiple vendor detections, low trust score, and inclusion on several blocklists collectively raise the risk rating to elevated. Defenders should add axiomsniffer.xyz to local deny lists, enforce DNS‑based filtering, and ensure that any traffic to the associated IP address 104.21.11.233 is blocked at the perimeter. Continuous monitoring of the Cloudflare IP range for re‑use of the address is advised, as the infrastructure could be repurposed for future malicious campaigns. Threat intelligence feeds should be updated to reflect the current offline status while retaining the indicator for future correlation.