account[.]xion-trader[.]com

This domain, account.xion-trader.com, is currently flagged as an active credential phishing operation targeting users through a deceptive login interface. Analysis indicates the domain was registered on March 22, 2026, through TuringSign Inc. operating as Cosmotown, with hosting provided by HostBet Cloud Technologies Private Limited in Germany. The domain resolves to IP address 86.107.77.57 and utilizes nameservers ns1.stablewebtech.com and ns2.stablewebtech.com, infrastructure commonly associated with low-reputation hosting environments. The site presents a page titled 'xiontraders' and employs a 301 HTTP redirect, a technique often used to obscure the final destination or to funnel victims through multiple layers of tracking. The SSL certificate is issued by Let's Encrypt (R13), a legitimate provider frequently abused by threat actors due to its free and automated issuance process. While the certificate itself does not indicate malicious intent, its presence on a domain with no legitimate business association raises suspicion. Security vendors have detected this domain as malicious, with 15 out of 95 engines on VirusTotal flagging it as harmful. The domain appears on three security blocklists and is actively blocked by multiple threat intelligence feeds, including those integrated into browser-based security tools. The Gridinsoft trust score of 0/100 further corroborates its classification as high-risk infrastructure. Defenders should treat this domain as an active threat. The combination of recent registration, low-reputation hosting, and confirmed blocklist presence aligns with known phishing patterns. Network-level blocking of the domain and its associated IP address is recommended, along with monitoring for related subdomains or newly registered lookalike domains. The lack of legitimate business ties or historical web presence suggests this infrastructure was created solely for malicious purposes.