auday[.]live

The domain auday.live was registered on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently reported as offline. DNS resolution points to the IPv4 address 95.85.236.106, which belongs to AS200823 (MHost LLC) and is geolocated in Germany. The domain is served without an SSL/TLS certificate, indicating that any client connection would be unencrypted. Nameserver records list fdomain.earth.orderbox-dns.com, fdomain.mars.orderbox-dns.com, and a partially captured fdomain.mer entry, suggesting reliance on the Orderbox DNS infrastructure.

The web page title returned during the brief live probe was "xlm-front," but no further content analysis is available because the site was taken down before a full scrape could be performed. Malware and phishing detection services have flagged the domain: four of ninety‑three VirusTotal scanners raised alerts, and the domain appears on a single external security blocklist. PhishDestroy has explicitly blocked the host, reinforcing the classification as a phishing vector.

The elevated risk rating aligns with the observed indicators, yet the limited visibility—absence of SSL, short‑lived online presence, and incomplete name server data—leaves the full scope of the malicious campaign uncertain. Defenders should continue to monitor the IP address 95.85.236.106 for any re‑activation, enforce blocklisting of the domain across web filtering solutions, and consider adding the associated nameservers to deny‑list policies. Network traffic to the hosting ASN should be inspected for anomalous payloads, and any residual references in email or URL filtering logs should be investigated to ensure that remnants of the phishing infrastructure are fully remediated.