axiom-trade-platform[.]com

Analysis of the domain axiom-trade-platform.com indicates active brand impersonation targeting Revolut users. The domain was registered on August 18, 2025, through GRANSY S.R.O D/B/A SUBREG.CZ, a registrar frequently associated with fraudulent infrastructure. Infrastructure reveals Cloudflare nameservers (alla.ns.cloudflare.com, hank.ns.cloudflare.com) and resolution to IP 185.62.58.189, hosted on AS62370 (Snel.com B.V.) in the Netherlands. A Let's Encrypt SSL certificate (E7) is present, and the site returns HTTP status 308, suggesting a redirect mechanism. The page title, 'Axiom Trade™ | The Official & Principal Site 【2025】,' explicitly claims official status, a common tactic in brand impersonation schemes. MX records point to mail.axiom-trade-platform.com, indicating potential use for phishing emails. Technologies detected include Nginx, Google Hosted Libraries, Google Font API, and HTTP/3, consistent with modern phishing kits designed to appear legitimate. Security vendor detections are notable: 20 of 95 vendors on VirusTotal flag the domain as malicious, while Scamadviser and Gridinsoft assign trust scores of 1/100 and 0/100, respectively. The domain appears on one security blocklist and was identified in a single AlienVault OTX threat intelligence pulse. No evidence confirms the exact phishing kit or payload, but the combination of brand impersonation, low trust scores, and active redirects suggests a high-risk operation. Defenders should treat this domain as malicious and prioritize blocking at DNS, IP, and SMTP layers. The use of Cloudflare and Let's Encrypt does not indicate legitimacy, as these services are routinely abused by threat actors. Further investigation into associated email infrastructure (mail.axiom-trade-platform.com) is recommended to identify related phishing campaigns.