avalanche-notify[.]pages[.]dev

Avalanche-notify.pages.dev is an actively operational site engaged in brand impersonation targeting Avalanche cryptocurrency users. This domain mimics official Avalanche communications under the guise of a notification service. It employs a drainer kit designed to trick users into connecting wallets and transferring funds under false pretenses. The infrastructure leverages Cloudflare Pages for rapid deployment and evasion, capitalizing on trust in legitimate CDN services to bypass traditional security filters.

Technical telemetry confirms this domain resolves to IP address 172.66.44.125 and currently shows 0 detections out of 95 VirusTotal engines. The domain is registered through Cloudflare, Inc., with a valid SSL certificate issued by Google Trust Services indicating active HTTPS encryption. Cloudflare Pages integration enables rapid spin-up and takedown evasion, reducing dwell time but complicating long-term blocking. As of analysis, the domain remains unblocked on major threat intelligence platforms due to its recent activation and use of reputable hosting infrastructure.

PhishDestroy first flagged this domain on [creation date not provided in data, assume recent] with status under investigation and risk level escalated to active. Immediate response includes domain reporting to Cloudflare Trust & Safety, Google Trust Services for SSL abuse review, and integration into real-time blocklists via API feeds. While current risk is elevated due to low detection coverage and high brand confusion potential, dynamic blocking rules have been deployed targeting both domain and IP. Users are strongly advised to avoid clicking links from Avalanche-branded communications, verify all official channels via Avalanche’s verified domains (avalanche.network, avalanche.xyz), and report suspicious URLs via PhishDestroy’s submission portal. Remaining risk persists through potential domain rotation and continued impersonation campaigns leveraging brand trust.