wallet-abrax-as[.]pages[.]dev

This domain, wallet-abrax-as.pages.dev, is flagged as an active brand impersonation threat targeting Ethereum users. Analysis indicates the site mimics legitimate cryptocurrency wallet services, specifically impersonating the Abraxas Wallet interface to harvest credentials and facilitate unauthorized fund transfers. The page title, 'Abraxas Wallet – Manage Bitcoin, Ethereum & Altcoins,' aligns with common tactics used in crypto drainer schemes to deceive users into entering private keys or seed phrases. No direct evidence of a specific drainer kit was observed, but the infrastructure and branding strongly suggest intent to compromise wallet security. Technical indicators confirm elevated risk. The domain was created on September 18, 2025, and is registered through Cloudflare, Inc. It resolves to the IP address 188.114.97.3 and employs SSL certification from Google Trust Services. Security vendor analysis on VirusTotal shows 11 out of 95 engines flagging the domain as malicious. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Detected technologies include HSTS, Cloudflare infrastructure, and HTTP/3, which are often leveraged to enhance perceived legitimacy while obscuring malicious activity. As of the latest assessment, wallet-abrax-as.pages.dev has been taken offline, likely due to automated takedown mechanisms or registrar intervention. However, the residual risk remains elevated for users who may have interacted with the domain prior to its deactivation. Organizations and individuals are advised to monitor for unauthorized transactions, revoke any connected wallet permissions, and verify the authenticity of cryptocurrency services before entering sensitive information. Proactive measures, such as updating security blocklists and educating users on recognizing brand impersonation tactics, are recommended to mitigate similar threats.