loavax[.]com

loavax.com was registered on 21 February 2026 and resolved to the Cloudflare address 104.21.90.235, an IP located in the United States and announced as AS13335. The site presented a valid SSL certificate identified as WE1, indicating that HTTPS connections were accepted. Threat intelligence sources have classified the domain as a brand‑impersonation campaign targeting Avalanche, and it appears on at least one public security blocklist.

PhishDestroy has already taken the domain offline, and the current status is listed as offline. VirusTotal scans show that eight of ninety‑five antivirus and URL‑filtering engines flagged the domain as malicious, confirming a consensus of moderate to high confidence among detection vendors. The domain also appears in two AlienVault OTX pulses, providing additional corroboration of its malicious use.

Although the exact page content has not been publicly released, the combination of brand impersonation, Cloudflare hosting, a recent registration date, and multiple vendor detections suggests a focused attempt to lure Avalanche users into credential harvesting or fraud. Defenders should add 104.21.90.235 to deny‑list rules, enforce DNS blocklists that include loavax.com, and monitor for any residual traffic or login attempts that reference the Avalanche brand. Continuous observation of OTX updates and re‑scanning of the domain after any potential re‑hosting is recommended to ensure that any re‑appearance is promptly identified.