axioms[.]live

On 22 July 2026, the domain axioms.live was observed hosting a phishing page with the browser title "Nur einen Moment…". The site resolved to IP 188.114.96.3, which belongs to Cloudflare Inc. (AS13335) and is geolocated in the United States. Registration was performed through NiceNIC International Group Co., Limited and the domain was created on 4 March 2026. No TLS certificate was presented, indicating the site operated over plain HTTP. DNS resolution used Cloudflare’s authoritative nameservers penny.ns.cloudflare.com and scott.ns.cloudflare.com.

Threat intelligence feeds have flagged the domain. Two of ninety‑four VirusTotal scanners raised detections, and the domain appears on three public blocklists, including PhishDestroy, MetaMask, and SEAL. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. The site was taken offline shortly after detection, and current probing returns no active service. Evidence gaps remain: the specific credential‑stealing payload, targeted brand, and the exact phishing kit have not been disclosed.

Consequently, analysts cannot confirm the exact victim profile or the method of data exfiltration. Nevertheless, the combination of a newly created domain, lack of TLS, low trust score, multiple vendor flags, and blocklist listings constitutes a high confidence indicator of phishing infrastructure. Defenders should add axioms.live to deny‑list rules, monitor for any resurgence of the domain or its IP, and ensure that traffic to the associated Cloudflare IP is inspected for anomalous HTTP requests. Network sensors should also watch for any future registrations that reuse the same registrar or nameservers, as adversaries often recycle these components. Continuous correlation with threat‑intel platforms is recommended to capture any emerging indicators tied to this infrastructure.