en-us-avalanche-explore[.]pages[.]dev

PhishDestroy identifies en-us-avalanche-explore.pages.dev as a brand impersonation site targeting Avalanche users. This domain uses Cloudflare-hosted infrastructure (IP 188.114.97.3) and a Google Trust Services SSL certificate to appear legitimate, likely deploying spoofed pages or fake updates to harvest credentials or inject malware. The threat actor leverages the genuine *.pages.dev domain structure to exploit trust in popular development platforms. This domain was flagged with 3/95 detections on VirusTotal as of the latest scan, indicating it has not yet been widely blacklisted despite active impersonation behavior. It is registered under Cloudflare, Inc., with no publicly visible creation date in WHOIS records. The combination of clean detection rates and trusted infrastructure suggests a recently deployed campaign with potential to evade automated filters and deceive security tools. Users who visited this site may have been exposed to credential theft prompts, malicious downloads, or browser-based exploits disguised as Avalanche software updates or documentation. If interaction occurred, disconnect from the network, run a full antivirus scan, and change Avalanche-related passwords from a known-safe device. Report any suspicious transactions or account access to Avalanche support immediately using official contact channels.