axvdex[.]zone

Analysis indicates that the domain axvdex.zone was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is currently hosted behind Cloudflare (AS13335) with the IP address 172.67.186.188 located in the United States. The site returns HTTP status 200 and presents the page title “Dashboard :: Astrovault”, suggesting a fabricated dashboard interface. Technical fingerprinting shows the presence of PHP and React, as well as Cloudflare Browser Insights and HTTP/3 support, consistent with a modern web stack delivered via Cloudflare’s edge network. The SSL certificate is issued by Google Trust Services under the WE1 label, confirming the use of a valid TLS chain. Reputation data shows that Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist.

VirusTotal reports that 2 of 93 scanned security vendors have flagged the domain, indicating some detection but not a consensus. PhishDestroy has already added the domain to its blocklist, reinforcing the classification as a phishing resource. No additional public threat‑intel sources such as OTX or Safe Browsing are referenced in the supplied data. The limited detection coverage and low trust score suggest the site is actively used for malicious purposes, but the exact phishing campaign details, targeted brand, or credential‑harvesting mechanisms remain unknown from the current evidence.

Defenders should block network traffic to 172.67.186.188 and add axvdex.zone to internal URL filtering lists. Monitoring for DNS queries to the Cloudflare nameservers crystal.ns.cloudflare.com and milan.ns.cloudflare.com can help identify compromised hosts. Continuous re‑scanning on VirusTotal and other multi‑engine platforms is advised to capture any new detections. Organizations should also educate users about unsolicited login‑style URLs that reference “Dashboard :: Astrovault” and enforce multi‑factor authentication where possible.