# PhishDestroy domain threat record: saxolimited.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/saxolimited.com/ Machine-readable companion: https://phishdestroy.io/domain/saxolimited.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-24 15:39:30 UTC - Last availability or vendor check: 2026-10-24 15:41:02 UTC - Stored record updated: 2026-10-24 18:04:27 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: coingecko ## Stored infrastructure - Observed IP address: 31.97.179.148 - Registrar in stored WHOIS data: Spaceship, Inc. - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-06-03 09:19:39 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a16e91-bfb7-7289-b333-2122d1306660/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/saxolimited.com - Certificate Transparency search: https://crt.sh/?q=%25.saxolimited.com - Web Archive lookup: https://web.archive.org/web/*/https://saxolimited.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s internal blocklist marks saxolimited.com as a suspicious domain. The recorded page title reads “Saxo Norden – Unlock Your Trading Potential Worldwide”. The domain was first observed by PhishDestroy on 2026-10-24 and returned an HTTP 200 response on that date. How the scam works The listing does not confirm a specific fraud technique, but domains that mimic legitimate trading platforms often aim to harvest login credentials, persuade victims to fund fake accounts, or collect personal data. Visitors who provide any account information may be exposed to credential theft or fraudulent investment schemes. Evidence VirusTotal scanned the domain on 2026-10-24 with 92 engines and reported zero malicious or suspicious detections. Google Safe Browsing checked on the same day and did not flag the site. An urlscan.io capture on 2026-10-24 gave an overall clean verdict, though its engine scoring flagged the URL as malicious with a score of 79. OTX listed one pulse referencing the domain on 2026-10-24. PhishDestroy’s internal blocklist includes the domain, while external blocklists returned no matches. Infrastructure The domain was registered on 2026-06-03 through Spaceship, Inc. The recorded IP was 31.97.179.148, which belonged to a Hostinger DE network in Germany. DNSSEC was enabled and the TLS certificate, issued by Let’s Encrypt/YR2, was valid until 2027-01-19. Open ports observed were 22, 80 and 443. Subdomains api.saxolimited.com, trader.saxolimited.com and www.saxolimited.com were also recorded. What to do Do not enter credentials, payment details or personal information on the site. If you have already submitted login data, change the associated passwords and enable two‑factor authentication where possible. Monitor financial accounts for unauthorized activity. Defenders should add saxolimited.com to blocklists, review access logs for connections to 31.97.179.148, and enforce policies that prevent credential reuse across services. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a16e91-bfb7-7289-b333-2122d1306660/ Cloudflare Radar report: https://radar.cloudflare.com/scan/7f6e2725-f579-4965-86a6-a0d128aef2ed Stored capture screenshot: https://i.ibb.co/Yrz5CgD/b869cfe00ef0.png Cloudflare Radar screenshot (2026-10-24T15:40:59Z): https://screenshots.phishdestroy.io/cf/7f6e2725-f579-4965-86a6-a0d128aef2ed.png URLScan screenshot (2026-10-24T04:47:19Z): https://screenshots.phishdestroy.io/us/01a16c3b-f4f1-73cf-aee8-2373fd3a7485.png URLScan capture report: https://urlscan.io/result/01a16c3b-f4f1-73cf-aee8-2373fd3a7485/ VirusTotal report: https://www.virustotal.com/gui/domain/saxolimited.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=saxolimited.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-24 15:42:42 UTC ## Stored page captures - Primary capture: https://i.ibb.co/Yrz5CgD/b869cfe00ef0.png Captured: 2026-10-24 15:41:02 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a16e91-bfb7-7289-b333-2122d1306660.png Captured: 2026-10-24 15:41:02 UTC Source report: https://urlscan.io/result/01a16e91-bfb7-7289-b333-2122d1306660/ - URLScan capture 2: https://urlscan.io/screenshots/01a16c3b-f4f1-73cf-aee8-2373fd3a7485.png Captured: 2026-10-24 15:39:30 UTC Source report: https://urlscan.io/result/01a16e91-bfb7-7289-b333-2122d1306660/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/7f6e2725-f579-4965-86a6-a0d128aef2ed.png Captured: 2026-10-24 15:40:59 UTC Source report: https://radar.cloudflare.com/scan/7f6e2725-f579-4965-86a6-a0d128aef2ed SHA-256: 3f54c1853c11209bb21f9abf252c03cb1377ec178f8d00a3e25a915066a1e1c4 - URLScan · 2026-10-24: https://screenshots.phishdestroy.io/us/01a16c3b-f4f1-73cf-aee8-2373fd3a7485.png Captured: 2026-10-24 04:47:19 UTC Source report: https://urlscan.io/result/01a16c3b-f4f1-73cf-aee8-2373fd3a7485/ SHA-256: af90f5a463a15edd2d8becc368db08defd5ba23a0db3f876637173af1ce28b19 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-24T15:41:48Z", "uuid": "01a16e91-bfb7-7289-b333-2122d1306660", "scanned_at": "2026-10-24T15:40:15Z", "final_url": "https://saxolimited.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://saxolimited.com/", "from": "http://saxolimited.com/", "status": 307 } ], "ip": "31.97.179.148", "ptr": "srv922048.hstgr.cloud", "domains": [ "fonts.gstatic.com", "api.coingecko.com", "fonts.googleapis.com" ], "ips": [ "142.251.14.94", "172.66.172.219", "192.178.183.95", "31.97.179.148" ], "asns": [ "15169", "13335", "47583" ], "countries": [ "US", "DE" ], "link_domains": [ "trader.saxolimited.com", "play.google.com", "apps.apple.com" ], "doc_hash": "3d54ff31572282e3988d0186aa283e4e1b5c6f9b13d8a1c307053e7661e2d3a3", "script_hashes": [ "94fef489f3cb3145a68d78b5db529c506d35e0d6f62bb8efe5510f6a0f698bff" ], "globals": [ "__reactRouterVersion", "MotionIsMounted" ], "storage_keys": [ "lswt-0.201782467141158660.3416333522280286" ], "tls": { "san": [ "api.saxolimited.com", "api.spde26.com", "crm.spde26.com", "saxolimited.com", "trader.saxolimited.com", "www.saxolimited.com" ], "cipher": "AES_128_GCM", "issuer": "YR2", "subject": "api.saxolimited.com", "protocol": "TLS 1.2", "valid_to": "2027-01-19T17:04:01Z", "valid_from": "2026-10-21T17:04:02Z" }, "domain_age_days": 141, "apex_age_days": 141, "tls_age_days": 2, "tls_valid_days": 89, "requests": 22, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 79, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "content-type": "text/html", "strict-transport-security": "max-age=31536000; includeSubDomains", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff" } }, "cf": { "v": 1, "fetched_at": "2026-10-24T15:41:50Z", "uuid": "7f6e2725-f579-4965-86a6-a0d128aef2ed", "scanned_at": "2026-10-24T15:40:59Z", "final_url": "https://saxolimited.com/", "status": 200, "history": [ { "url": "https://saxolimited.com/", "status": 200 } ], "dom_hash": "d8af3d5ff1011fe35b9b1c13b88e5cda6528118a78c2b9ece3b48d67a69c4795", "doc_hash": "3d54ff31572282e3988d0186aa283e4e1b5c6f9b13d8a1c307053e7661e2d3a3", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "saxolimited.com", "type": "A", "value": "31.97.179.148" } ], "dnssec_valid": true, "ip": "31.97.179.148", "whois": { "registrar": "Spaceship, Inc.", "created": "2026-06-03T11:19:39Z", "updated": "2026-06-03T11:19:40Z", "expires": "2027-06-03T11:19:39Z", "nameservers": [ "launch1.spaceship.net", "launch2.spaceship.net" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-24T15:40:52Z", "analysis_at": "2026-10-24T05:16:30Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 0, "undetected": 37 }, "reputation": 0, "registrar": "Spaceship, Inc.", "created": "2026-06-03T11:19:39Z", "expires": "2027-06-03T11:19:39Z", "updated": "2026-06-03T11:19:40Z", "first_seen": "2026-06-19T01:45:00Z", "dns": [ { "ttl": 1800, "type": "NS", "value": "launch1.spaceship.net" }, { "ttl": 1800, "type": "A", "value": "31.97.179.148" }, { "ttl": 1800, "type": "SOA", "rname": "support.spaceship.com", "value": "launch1.spaceship.net" }, { "ttl": 300, "type": "TXT", "value": "v=spf1 include:spf.spacemail.com ~all" }, { "ttl": 1800, "type": "NS", "value": "launch2.spaceship.net" }, { "ttl": 300, "type": "MX", "value": "mx2.spacemail.com", "priority": 0 }, { "ttl": 300, "type": "MX", "value": "mx1.spacemail.com", "priority": 0 } ], "dns_at": "2026-10-24T05:21:51Z", "jarm": "29d29d00029d29d00029d29d29d29da5fc7ec76b7ed0b839211317d3844486", "cert": { "san": [ "api.saxolimited.com", "api.spde26.com", "crm.spde26.com", "saxolimited.com", "trader.saxolimited.com", "www.saxolimited.com" ], "issuer": "Let's Encrypt / YR2", "serial": "5a96e8edf412e5e693117e3eb7a6cd1155b", "sha256": "66e2b4ff2aecd1225d6355b140cf49076bc66bb427c65aba36d1398866956880", "subject": "api.saxolimited.com", "valid_to": "2027-01-19T17:04:01Z", "valid_from": "2026-10-21T17:04:02Z" }, "whois": { "registrar": "Spaceship, Inc.", "registrar_iana_id": "3862", "registrar_url": "http://www.spaceship.com", "created": "2026-06-03T11:19:39Z", "updated": "2026-06-03T11:19:40Z", "expires": "2027-06-03T11:19:39Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "launch1.spaceship.net", "launch2.spaceship.net" ], "dnssec": "signedDelegation" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "last changed": "2026-08-21T19:24:49Z", "registration": "2026-06-03T11:19:39Z", "registrar expiration": "2027-06-03T11:19:39Z", "last update of RDAP database": "2026-10-21T19:32:19Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-24T15:42:05Z", "mail_config": { "mx": [ "mx1.spacemail.com", "mx2.spacemail.com" ], "spf": "v=spf1 include:spf.spacemail.com ~all", "spf_lookups": 2 }, "caa_records": { "domain": "saxolimited.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-24T15:39:57Z", "first": "2026-10-24T15:39:57Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 1615 }, "robots_txt": { "agents": [ "*" ], "present": true }, "social_tags": { "title": "Saxo Norden - Unlock Your Trading Potential Worldwide", "author": "Saxo Norden", "ogType": "website", "robots": "noindex, nofollow", "ogImage": "/og-image.jpg", "ogTitle": "Saxo Norden - Unlock Your Trading Potential Worldwide", "keywords": "trading platform, forex trading, crypto trading, AI trading, stocks, commodities, investment, saxo group", "description": "Access global markets with cutting-edge AI technology, institutional security, and lightning-fast execution. Join thousands of successful traders building wealth today.", "twitterCard": "summary_large_image", "twitterSite": "@SaxoGroup", "canonicalUrl": "https://saxolimited.com", "ogDescription": "Access global markets with cutting-edge AI technology, institutional security, and lightning-fast execution." }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 46, "tls": 122, "wait": 39, "connect": 5, "download": 0 }, "response_ms": 212 }, "tls_connection": { "alpn": "h2", "cipher": "ECDHE-RSA-AES128-GCM-SHA256", "protocol": "TLSv1.2", "versions": [ "TLSv1.2" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 22, 80, 443 ] }, "carbon": { "bytes": 1561, "co2_grams": 0.0001, "cleaner_than": 95 }, "dns_server": { "ns": [ { "ip": "162.159.26.38", "host": "launch1.spaceship.net" }, { "ip": "162.159.27.32", "host": "launch2.spaceship.net" } ], "zone": "saxolimited.com" }, "location": { "ip": "31.97.179.148", "asn": "47583", "org": "Hostinger DE", "city": "Frankfurt am Main", "country": "DE" }, "ssl": { "issuer": "Let's Encrypt / YR2", "subject": "api.saxolimited.com" }, "dns": { "A": [ "31.97.179.148" ], "MX": [ "{\"exchange\": \"mx1.spacemail.com\", \"priority\": 0}", "{\"exchange\": \"mx2.spacemail.com\", \"priority\": 0}" ], "NS": [ "launch1.spaceship.net", "launch2.spaceship.net" ], "SOA": "{\"nsname\": \"launch1.spaceship.net\", \"hostmaster\": \"support.spaceship.com\", \"serial\": 1782941996, \"refresh\": 43200, \"retry\": 3600, \"expire\": 604800, \"minttl\": 3600}", "TXT": [ "v=spf1 include:spf.spacemail.com ~all" ] }, "dnssec": { "ds": true, "rrsig": true, "dnskey": true }, "hsts": { "header": "max-age=31536000; includeSubDomains", "message": "HSTS header does not contain the preload directive." }, "http_security": { "xFrameOptions": "SAMEORIGIN", "referrerPolicy": false, "xXSSProtection": "1; mode=block", "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": false, "strictTransportPolicy": "max-age=31536000; includeSubDomains", "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "31.97.179.148", "family": 4 }, "redirects": { "chain": [ "https://saxolimited.com" ] }, "subdomains": { "count": 3, "subdomains": [ "api.saxolimited.com", "trader.saxolimited.com", "www.saxolimited.com" ] }, "social_presence": { "profiles": [ "https://x.com/SaxoGroup" ] }, "whois": { "registrar": "Spaceship, Inc.", "created": "2026-06-03T11:19:39Z", "updated": "2026-06-03T11:19:40Z", "expires": "2027-06-03T11:19:39Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "launch1.spaceship.net", "launch2.spaceship.net" ] }, "headers": { "headers": { "content-type": "text/html", "strict-transport-security": "max-age=31536000; includeSubDomains", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff" } } } } ```