abra-xas-home-auth[.]pages[.]dev

The domain abra-xas-home-auth.pages.dev is currently active and flagged as a high-risk phishing site targeting users of the Abraxas Wallet cryptocurrency service. Analysis indicates the page presents itself as "Abraxas Wallet - Digital Innovation for Secure Transactions," a title designed to mimic legitimate wallet platforms. The domain was registered on October 4, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3. It is hosted on infrastructure utilizing HSTS, Cloudflare, and HTTP/3, which may complicate detection and takedown efforts due to the use of modern security and performance technologies. Infrastructure review reveals the domain is listed on one security blocklist, specifically PhishDestroy, and has been flagged by 1 of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services, a common provider for both legitimate and malicious sites, which does not inherently indicate trustworthiness. The Gridinsoft trust score of 0/100 further supports the assessment of malicious intent. While the domain remains operational as of July 12, 2026, the limited number of detections suggests it may still be in the early stages of deployment or evading broader detection mechanisms. Defenders should prioritize blocking this domain at the network level, particularly in environments where cryptocurrency-related services are accessed. The use of Cloudflare hosting and modern web technologies may allow the site to bypass basic reputation-based filters, so additional scrutiny of HTTP/3 traffic and HSTS enforcement is recommended. Given the targeting of cryptocurrency users, organizations should also monitor for related credential harvesting attempts or wallet-draining malware linked to this campaign. No confirmed association with known phishing kits or threat actor groups has been established at this time, but the domain’s structure and hosting pattern align with common phishing tactics.