funds-axis[.]ltd

The domain funds-axis.ltd is identified as a credential theft threat. This domain engaged in phishing activities aimed at deceiving users into submitting sensitive information under the guise of legitimate operations. The use of technologies such as PHP, Bootstrap, and Smartsupp, alongside the deployment of hCaptcha for form submissions, suggests a sophisticated attempt to mimic legitimate business interfaces to gain user trust and extract credentials.

Technical investigation reveals significant indicators of compromise. The domain is flagged by 6 out of 95 security vendors on VirusTotal, indicating a consensus on its malicious intent. The domain was registered through Registrar.eu, which is a known provider for various online services. It resolves to the IP address 84.32.84.74 and had an SSL certificate issued by Let's Encrypt, which is often used in phishing schemes due to its free nature. The domain's presence on 2 security blocklists, including those maintained by PhishDestroy and OISD, underscores its malicious profile. Additionally, it has been included in 5 threat intelligence pulses on AlienVault OTX, further corroborating its involvement in fraudulent activities.

Currently, funds-axis.ltd is offline, which mitigates its immediate threat. However, the domain's previous activity poses a risk of reactivation or replication under different names. It is recommended to monitor for similar domains and maintain vigilance for phishing attempts that mimic legitimate brands. Users should be advised to verify URLs and use multi-factor authentication to protect against credential theft. Security teams should update blocklists and threat intelligence feeds to reflect this domain's status and reduce the potential for future exploitation.