axidaivip[.]com

Analysis indicates that the domain axidaivip.com was registered on 6 April 2026 through Dominet (HK) Limited and is hosted on an Amazon CloudFront node in Germany (IP 18.66.112.105). The DNS configuration uses ns7.alidns.com and ns8.alidns.com as authoritative nameservers. The site presents the page title “AxiDa”, but no further content has been captured because the host is currently taken offline. Reputation services place the domain in the lower half of their trust scales: Gridinsoft assigns a score of 35 out of 100, while Scamadviser rates it at 46 out of 100.

The domain appears on three public blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, confirming its classification as a phishing vector. An AlienVault OTX pulse references the domain, indicating that at least one community‑generated indicator set has logged it as malicious. VirusTotal scans show that seven out of ninety‑four antivirus engines flagged the domain, reinforcing the suspicion of malicious activity. The SSL certificate is issued by Amazon and uses a standard RSA‑2048 key (Amazon RSA 2048 M04), which is typical for CloudFront‑hosted sites and does not provide any additional trust.

Because the site is currently offline, active probing is limited, and the exact payload or credential‑harvesting mechanism remains unknown. Defenders should continue to block the domain at perimeter devices, update URL filtering rules to include the observed blocklist entries, and monitor for any future DNS resolution to the same IP address or related CloudFront ranges. Incident response teams should also check for any recent authentication attempts that may have involved the domain, especially if users reported phishing‑like emails referencing “AxiDa”. Ongoing observation of the registrar and nameserver activity is advised, as changes could indicate a re‑deployment of the phishing infrastructure.