philusltd[.]com

This domain is flagged for elevated-risk brand impersonation targeting the Avalanche cryptocurrency platform. Analysis indicates the infrastructure is designed to deceive users into interacting with fraudulent blockchain services, potentially facilitating unauthorized asset transfers or credential harvesting. The specific threat type—crypto brand impersonation—exposes victims to direct financial loss through malicious smart contract interactions or fake wallet integrations. Infrastructure analysis reveals the domain philusltd.com was registered on May 17, 2025, through Dynadot LLC, a registrar frequently observed in fraudulent campaigns. It resolves to the IP address 107.172.61.186, which has been associated with prior malicious activity. Detection metrics show 7 out of 95 security vendors on VirusTotal flagged the domain, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist and is currently offline, though historical captures confirm it hosted a site titled 'Philus - Home' with technologies including Bootstrap, Nginx, and Google Analytics. The SSL certificate was issued by Let’s Encrypt, a common choice for threat actors due to its low-cost automation. Mitigation requires immediate action from both users and security teams. Users who interacted with the domain should revoke any connected wallet permissions, rotate credentials, and monitor transaction histories for unauthorized activity. Security teams should block the domain and IP at the network level, while also alerting users to the impersonation risk. Given the domain’s recent creation and association with Avalanche, organizations should prioritize monitoring for similar typosquatting or brand-abusing domains, particularly those mimicking cryptocurrency platforms. Proactive measures include deploying browser-based crypto transaction warnings and educating users on verifying official platform URLs before connecting wallets.