vixtrade[.]net

Analysis as of July 27 2026 indicates that the domain vixtrade.net remains active and is being used in a generic phishing campaign. The domain was registered on 24 December 2025 through Atak Domain and is served by four authoritative name servers (ns1.srv-console.com through ns4.srv-console.com). DNS resolution points exclusively to the IPv4 address 45.67.136.10, which is currently listed on one public security blocklist and is actively blocked by the PhishDestroy feed. VirusTotal reports a single positive detection out of 91 scanned engines, confirming that at least one security vendor has identified malicious behavior associated with the domain. No additional public threat‑intel sources such as OTX, Google Safe Browsing, or other blocklists are cited in the available data, and the page title, SSL certificate details, HTTP response codes, and trust‑score metrics have not been published, leaving those aspects of the infrastructure unverified.

The limited evidence suggests a straightforward credential‑harvesting infrastructure: the domain’s short age, single‑IP hosting, and inclusion on a phishing‑specific blocklist are typical of campaigns that host malicious login pages or redirect victims to credential‑stealing sites. However, without a captured landing page or malware sample, the exact phishing vector, targeted brand, or payload cannot be confirmed. The presence on a single blocklist indicates that the domain has already been flagged by at least one community‑maintained list, but the low number of listings suggests limited exposure or recent deployment. The registrar Atak Domain has historically been used by other malicious operators, which may increase confidence in the risk assessment.

Because the domain is only a month old at the time of writing, threat actors may still be testing delivery methods, and the infrastructure could evolve to include additional IPs or payloads. Defenders should therefore treat any traffic to vixtrade.net as hostile.