auvex[.]one

The domain auvex.one is currently active and hosts a generic phishing page. DNS resolution points to Cloudflare’s edge address 104.21.46.175 and the zone is delegated to grace.ns.cloudflare.com and marek.ns.cloudflare.com. The site presents a TLS certificate issued by Google Trust Services under the WE1 authority, indicating a valid HTTPS endpoint. An HTTP request returns a 403 status code and the page title is “Just a moment…”, which matches the observed indicator set. The domain is listed on three public phishing blocklists and is actively blocked by the PhishDestroy, MetaMask, and SEAL filters. Registration information shows the domain was purchased through NameSilo, LLC. The infrastructure resides in Cloudflare’s network in Canada. Although recent VirusTotal analysis involving 91 scanning engines has not produced any detections, the presence on multiple blocklists and the observed behavior confirm malicious intent. Defenders should add auvex.one to DNS‑ and URL‑filtering rules, monitor for any C‑NAME or IP changes, and consider enforcing TLS inspection to capture any payload that may be delivered after the initial 403 response. Continuous threat‑intel feeds should be consulted for updates, and any user‑facing applications that rely on external content should be hardened against potential credential‑stealing redirects from this domain.