# avax-treasury.com — SUSPICIOUS

> Beware: avax-treasury.com is a crypto drainer impersonating Avalanche. 2 of 95 security vendors flag this domain. Verify safety on PhishDestroy before you click.

## Summary
PhishDestroy identifies avax-treasury.com as an active crypto drainer domain impersonating the Avalanche brand to trick users into connecting wallets or entering seed phrases. The domain masquerades as an official Avalanche treasury portal, luring victims with false promises of staking rewards or governance participation. Once a user engages, the site executes malicious JavaScript payloads that drain connected cryptocurrency wallets of tokens and NFTs without requiring explicit confirmation, exploiting trust in the Avalanche ecosystem to maximize impact.

This domain was flagged by 2 out of 95 VirusTotal security vendors within hours of creation. It is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and went live on March 21, 2026. The infrastructure resolves to IP 188.114.96.3 and leverages a Let's Encrypt SSL certificate to appear legitimate. These technical indicators, combined with the short domain age and low detection rate, suggest a newly deployed campaign with high evasion potential targeting Avalanche users who may not yet be aware of the threat.

If you visited avax-treasury.com, immediately disconnect your wallet from any suspicious dApps, revoke any unintended token approvals via your wallet interface or Etherscan, and transfer remaining assets to a clean wallet. Scan your device for malware and change passwords for all crypto-related accounts. Report the domain to PhishDestroy to help protect others. Always verify URLs against official Avalanche channels and use hardware wallets for large holdings to reduce exposure to drainer scripts.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Avalanche

## Domain Intelligence
- Registered: 2026-03-21 12:46:16
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 2 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/1484dd5b-aa1d-47e8-a34e-49c5e142403a
- PhishDestroy: https://phishdestroy.io/domain/avax-treasury.com/
- LLM endpoint: https://phishdestroy.io/domain/avax-treasury.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/avax-treasury.com/
Last updated: 2026-03-22