pc[.]axeldeal[.]com

Analysis of the domain pc.axeldeal.com confirms its role as an active phishing endpoint targeting cryptocurrency wallet users. Registered on May 15, 2026, through a registrar based in Singapore, the domain resolves to the IP address 172.67.205.243, which is hosted on infrastructure associated with a content delivery network in Canada. The site returns an HTTP 200 status code and presents a page titled 'AXEL,' a likely reference to a cryptocurrency wallet or service, suggesting an intent to deceive users into disclosing credentials or private keys. Infrastructure review reveals the domain uses nameservers bill.ns.cloudflare.com and deborah.ns.cloudflare.com, consistent with a pattern observed in other phishing campaigns leveraging distributed hosting to evade takedowns. The SSL certificate, issued by Google Trust Services under the WE1 intermediate, provides a valid encryption layer, which may lend a false sense of legitimacy to potential victims. Despite this, the domain appears on three independent security blocklists and is actively blocked by at least three security providers, including one specialized in cryptocurrency fraud prevention. VirusTotal detections show that three out of ninety-five security vendors flag the domain as malicious, a relatively low ratio that may reflect either the recent deployment of the site or the use of evasion techniques. The domain remains operational as of July 12, 2026, with no indication of suspension or remediation. Defenders should treat this domain as a high-risk indicator and prioritize blocking both the domain and its resolving IP address at the network perimeter. Endpoint protection systems should be updated to recognize the domain as a confirmed phishing resource, particularly in environments where cryptocurrency transactions or wallet access occur.