wax[.]app-stage-front[.]com

Analysis of wax.app-stage-front.com shows that the domain was registered on March 05, 2026 through DEVEXPANSE LTD d/b/a Regery.com and is hosted on Cloudflare's network (AS13335) with the IP address 104.21.15.245 located in the United States. The domain uses the Cloudflare nameservers aron.ns.cloudflare.com and vasilii.ns.cloudflare.com, and serves content over HTTP without an SSL certificate. Technological fingerprints indicate a Node.js stack with Vue.js, Nuxt.js, jQuery and resources from cdnjs, as well as Cloudflare Browser Insights and HTTP/3 support. The page title returned by the live endpoint was “Wax – All In One KnowledgeOS”. No TLS certificate was observed, which suggests the site was reachable only via plain HTTP before being taken offline.

Threat intelligence sources have classified the site as a generic phishing infrastructure. Two of ninety‑four VirusTotal scanners flagged the domain, and it appears on two external blocklists that have already blocked it through services such as PhishDestroy and ScamSniffer. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment. The current status is offline, indicating that the phishing campaign may have been abandoned or temporarily disabled. Defenders should continue to block the domain at perimeter filters, DNS resolvers, and web proxies.

Because the domain resolves to a shared Cloudflare address, any future re‑use of the same IP range should be monitored for similar signatures. Ongoing watch‑list updates for the registrar DEVEXPANSE LTD and the associated nameservers are recommended. Additional investigation of the page content, if it reappears, would be required to confirm the exact phishing lure and any credential‑harvesting forms. Until further evidence is gathered, the domain should be treated as high‑risk and excluded from allowlists.