login-axiom[.]trade

This domain is flagged as an active brand impersonation threat designed to deceive users of the Across protocol. Analysis indicates the infrastructure is tailored for credential theft or unauthorized transaction redirection, leveraging the trust associated with the targeted brand. The domain presents a calculated risk to users who may unknowingly interact with it under the false pretense of legitimacy. Infrastructure analysis reveals the following technical indicators: the domain login-axiom.trade was registered through NameSilo, LLC on February 27, 2026, and currently resolves to the IP address 188.114.96.3. At the time of assessment, VirusTotal reported 0 detections out of 95 security engines, suggesting the domain has not yet been widely flagged. However, it appears on three security blocklists, including those maintained by MetaMask, PhishDestroy, and SEAL. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious domains. Technologies detected include Cloudflare Browser Insights, Cloudflare, and HTTP/3, which are frequently used to obfuscate hosting origins and enhance performance. To mitigate risks associated with this brand impersonation threat, users should verify domain authenticity by cross-referencing official communications from the Across protocol. Any interaction with login-axiom.trade or similar domains should be avoided, particularly those soliciting credentials or transaction approvals. Network-level protections, such as DNS filtering or endpoint detection rules, should be updated to block access to the domain and its associated IP address. Organizations are advised to monitor for unusual login attempts or transaction patterns that may indicate compromise stemming from this campaign. Proactive measures, including user education on recognizing spoofed domains and enabling multi-factor authentication, are critical to reducing exposure to such threats.