axora[.]st

This domain, axora.st, is identified as a fake service portal phishing site designed to harvest user credentials by mimicking legitimate login interfaces. Analysis indicates the infrastructure was specifically crafted to deceive visitors into entering sensitive information, such as usernames, passwords, or other authentication details, under the guise of a trusted service. The domain’s deceptive design and rapid takedown suggest a targeted campaign aimed at exploiting unsuspecting users during a short-lived operational window. Infrastructure analysis reveals multiple concrete indicators of malicious activity. The domain was registered on March 06, 2026, through ST Registry, a registrar frequently associated with high-risk domains. It resolves to the IP address 151.247.193.142 and is currently flagged by 5 out of 95 security vendors on VirusTotal, including detection as a phishing threat. Additionally, the domain appears on one security blocklist and was proactively blocked by enterprise-grade filtering systems. The SSL certificate, issued by Let’s Encrypt, is a common tactic used by threat actors to lend a false sense of legitimacy to malicious sites. Users who visited axora.st or interacted with its content should take immediate remedial actions to mitigate potential risks. Any credentials entered on the site must be considered compromised and should be changed immediately across all platforms where the same or similar passwords were used. Affected individuals should also monitor their accounts for unauthorized activity, such as logins from unfamiliar locations or devices, and enable multi-factor authentication where available. If financial or personally identifiable information was submitted, users are advised to report the incident to relevant authorities and consider placing a fraud alert on their credit profiles. The domain’s current offline status does not eliminate the risk, as harvested data may still be exploited by threat actors.