saxonia[.]org

This domain, saxonia.org, is identified as a generic phishing site targeting users of the SAXO platform, likely a cryptocurrency wallet or trading service. Analysis of the page title, which reads 'SAXO,' indicates an attempt to mimic the legitimate brand for credential harvesting or wallet-draining purposes. No specific drainer kit signatures were confirmed, but the use of modern frontend frameworks suggests an effort to create a convincing replica of the target service interface. Infrastructure analysis reveals the domain was registered on April 02, 2025, through Gname.com Pte. Ltd. It is flagged by 5 out of 95 security vendors on VirusTotal and appears in 2 AlienVault OTX threat intelligence pulses. The domain is present on three security blocklists and is actively blocked by multiple detection systems. Detected technologies include Vue.js, Marked, Cloudflare Browser Insights, and Cloudflare CDN, with HTTP/3 support for improved performance and obfuscation. The Gridinsoft trust score for this domain is 0/100, reinforcing its malicious classification. As of the latest verification, saxonia.org has been taken offline, reducing immediate exposure risk. However, the domain remains registered and could be reactivated or repurposed for future campaigns. Users who interacted with the site prior to its takedown should assume credential compromise and take corrective actions, including revoking access to linked wallets, rotating passwords, and monitoring for unauthorized transactions. Organizations are advised to maintain blocklist updates and monitor for related infrastructure using the unique seed identifier f571ad.