home-abrxas-secure[.]pages[.]dev

This domain, home-abrxas-secure.pages.dev, is actively engaged in credential phishing targeting cryptocurrency users through a fraudulent wallet login interface. Analysis confirms the page impersonates Abraxas Wallet, a legitimate crypto asset management platform, to deceive victims into submitting sensitive credentials or seed phrases. The campaign remains operational as of the latest verification, with no takedown measures observed. Infrastructure analysis reveals the domain was deployed via Cloudflare Pages and resolves to the IP address 172.66.47.9, geolocated to Canada under Cloudflare, Inc. The SSL certificate is issued by Google Trust Services (WE1), a common configuration for malicious sites leveraging legitimate CDN infrastructure. Detection metrics indicate 4 of 95 security vendors on VirusTotal have flagged the domain, while it appears on one security blocklist. The domain was registered on April 2, 2026, though this date may reflect automated provisioning rather than traditional WHOIS records. The site remains active and poses a high risk to users due to its convincing mimicry of the Abraxas Wallet brand. Security teams are advised to block the domain and IP at the network level, while users should verify wallet authenticity through official channels only. Organizations should monitor for credential submissions or wallet-draining transactions linked to this infrastructure, particularly those originating from phishing lures referencing Abraxas. No legitimate wallet functionality is present on this domain.