phoraonsecxhenge[.]org

Analysis of the domain phoraonsecxhenge.org indicates a confirmed brand impersonation campaign targeting Avalanche, a decentralized finance platform. The domain was registered on October 9, 2025, through NameSilo, LLC, a registrar frequently associated with abusive registrations. Infrastructure analysis reveals resolution to IP address 172.67.156.146, hosted on Cloudflare's network (AS13335) in the United States, a common pattern for phishing sites leveraging Cloudflare's proxy services to obscure origin servers. The domain's nameservers, eleanor.ns.cloudflare.com and moura.ns.cloudflare.com, further confirm Cloudflare as the DNS provider. No SSL certificate was detected, increasing the likelihood of interception or man-in-the-middle risks for visitors.

The page title, 'Pharaoh Exchange | Concentrated Liquidity & DEX on Avalanche,' explicitly references Avalanche and decentralized exchange functionality, aligning with the reported scam type of brand impersonation. Detection metrics corroborate malicious intent: the domain appears on one security blocklist and was flagged by PhishDestroy. AlienVault OTX includes the domain in a single threat intelligence pulse, suggesting limited but confirmed exposure in threat-sharing communities. Gridinsoft assigns a trust score of 0/100, reflecting high confidence in malicious classification. VirusTotal reports five detections from security vendors, though the absence of a full scan (95 engines) limits contextual assessment.

Defenders should treat this domain as a confirmed phishing resource targeting Avalanche users. The lack of SSL, reliance on Cloudflare proxying, and recent registration date (less than nine months old at the time of analysis) are consistent with short-lived phishing infrastructure. The domain is currently offline, but historical resolution data and threat intelligence pulses may still pose risks for retrospective detection or incident response.