axia-trade[.]com

The domain axia-trade.com is currently active and confirmed to facilitate credential theft operations targeting users of financial service platforms. Analysis indicates the site is designed to harvest login credentials, likely for unauthorized account access or fraudulent transactions. No specific brand impersonation has been conclusively identified, but the domain structure and content suggest an intent to mimic legitimate trading or investment services. Infrastructure analysis reveals the domain was registered on January 18, 2024, through NameCheap, Inc. It resolves to the IP address 172.66.43.98 and is secured with an SSL certificate issued by Google Trust Services (WE1). The domain appears on one security blocklist and is flagged by 2 of 95 vendors on VirusTotal, including detection by PhishDestroy. The low vendor detection rate may indicate either a recently deployed campaign or evasion techniques to bypass automated scanning. The site remains operational as of the latest verification, posing a high risk to users who may be deceived into entering sensitive information. Organizations and individuals are advised to block the domain and associated IP at the network level. Users should be alerted to the threat, particularly those in financial sectors, and instructed to verify the legitimacy of any trading or investment platform before entering credentials. Monitoring for similar domains registered through the same registrar or resolving to the same IP may help identify related malicious infrastructure.