abrxas-wallet-en[.]pages[.]dev

This domain is flagged as a high-risk crypto drainer targeting cryptocurrency wallet users. Analysis indicates the infrastructure is designed to siphon digital assets through deceptive wallet interfaces, a tactic increasingly observed in targeted financial fraud campaigns. The domain presents itself as "Abraxas Wallet & Data — Private, Powerful, Purposeful," mimicking legitimate wallet services to exploit user trust. Infrastructure analysis reveals the domain abrxas-wallet-en.pages.dev was registered on October 14, 2025, through Cloudflare, Inc. It resolves to the IP address 188.114.97.3, geolocated to Canada and associated with Cloudflare’s network. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious sites leveraging Cloudflare’s hosting. Detection metrics show 1 out of 95 security vendors on VirusTotal flag the domain as malicious. The domain appears on one security blocklist and is actively blocked by PhishDestroy. Despite minimal vendor detections, the domain remains operational, suggesting either evasion techniques or recent deployment. Mitigation requires immediate action from both end-users and network defenders. Users should verify wallet interfaces by cross-referencing official project URLs and avoiding interaction with unsolicited wallet prompts. Network-level protections should include blocking the domain abrxas-wallet-en.pages.dev and its resolving IP 188.114.97.3 at firewalls and DNS resolvers. Security teams are advised to monitor for connections to this infrastructure, particularly in environments handling cryptocurrency transactions. Given the high-risk nature of crypto drainers, incident response protocols should prioritize asset isolation and credential rotation for any potentially exposed accounts.