connexion-ascendex[.]com

This domain, www.connexion-ascendex.com, operates as a credential harvesting portal designed to impersonate Apple's authentication systems. The site presents a fabricated login interface under the guise of "Connexion AscendEX | Accédez à votre compte de trading en toute sécurité," leveraging Apple's brand identity to deceive users into submitting sensitive account credentials. The attack vector focuses on social engineering, exploiting trust in Apple's ecosystem to capture usernames, passwords, and potentially multi-factor authentication tokens. Analysis indicates the domain was specifically crafted to target French-speaking users, as evidenced by the localized page title and language used in the interface. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on July 09, 2025, through NiceNIC International Group Co., Limited, and currently resolves to IP address 95.129.234.137, hosted on AS57724 (DDOS-GUARD LTD) in Russia. VirusTotal detection shows 17 out of 95 security vendors flagging the domain as malicious, while PhishDestroy has explicitly blocked it. The domain appears on one security blocklist, and its SSL certificate, issued by Let's Encrypt (R13), was likely obtained to lend an appearance of legitimacy to the fraudulent site. The combination of recent registration, brand impersonation, and hosting on a bulletproof provider further corroborates the malicious intent. Users who visited www.connexion-ascendex.com should immediately assume their credentials have been compromised. The first step is to change passwords for any Apple accounts or other services where the same credentials may have been reused. Enable multi-factor authentication if not already active, using an authenticator app rather than SMS-based methods. Monitor Apple ID and linked financial accounts for unauthorized transactions or configuration changes. If payment details were entered, contact financial institutions to issue new cards and review recent transactions. Report the incident to Apple's security team and consider filing a report with local cybercrime authorities. The domain has been taken offline, but threat actors may deploy similar infrastructure using different domains or IPs.