axiomexchange[.]io

Analysis of axiomexchange.io indicates a high-risk brand impersonation domain targeting the MEXC cryptocurrency exchange. The domain was registered on February 16, 2026, through Name.com, Inc., and currently resolves to the IP address 216.150.1.193. It is actively flagged by multiple security sources, including three threat intelligence pulses on AlienVault OTX and three security blocklists, with blocking implemented by SEAL, MetaMask, and PhishDestroy. The domain's SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites, and it employs HSTS alongside Vercel hosting technology. The page title, 'Axiom Exchange — Trade Crypto on Solana's Fastest On-Chain Exchange,' explicitly positions the site as a cryptocurrency trading platform, aligning with the known impersonation of MEXC. While five of 95 security vendors on VirusTotal have flagged the domain, this detection rate alone does not confirm malicious activity but corroborates broader indicators of compromise. Infrastructure analysis reveals no legitimate association with MEXC, and the domain's Gridinsoft trust score of 0/100 further supports its classification as fraudulent. Defenders should treat this domain as an active threat. Network-level blocking is recommended, particularly for organizations handling cryptocurrency transactions or users of MEXC. No evidence suggests the site has been taken down, and its continued resolution to an active IP indicates ongoing risk. The exact content and functionality of the site remain unanalyzed, but the combination of brand impersonation, security vendor detections, and blocklist inclusion provides sufficient grounds for immediate mitigation.