womanadla[.]org[.]za[.]xconnexion[.]co[.]za

Analysis of womanadla.org.za.xconnexion.co.za indicates that the domain is currently offline but was previously serving HTTP content that returned a 200 OK status with the page title "Index of /". The domain resolves to the IPv4 address 91.121.60.232, which is assigned to AS16276 operated by OVH SAS in France. Hosting under OVH suggests a reliable infrastructure often abused by malicious actors. The domain was registered on 28 January 2022 through the registrar Woza Domains and uses the nameservers ns1.cloudoon.com, ns2.cloudoon.net, and ns3.cloudoon.org. TLS termination is provided by a Let’s Encrypt certificate (R13), and the server supports HTTP/3, indicating a relatively modern web stack.

Detection data show that 11 of 95 security engines on VirusTotal flagged the domain, and Google Safe Browsing classifies it as hosting unwanted software. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy solution. The combination of multiple vendor detections, a zero trust score, and explicit safe‑browsing warnings supports a high‑risk classification.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanism because the captured page content is limited to the generic directory listing "Index of /". No additional indicator such as targeted brand, login form, or malware payload has been observed. Consequently, defenders should treat any traffic to the host as malicious, enforce blocklisting at network perimeters, and monitor for any resurgence of the domain or related sub‑domains. Continuous observation of the associated IP range and the three cloudoon nameservers is advised, as they may host further phishing infrastructure.