abrsxs-wallet[.]pages[.]dev

Analysis indicates that abrsxs-wallet.pages.dev is currently active and hosted behind Cloudflare infrastructure (IP 172.66.44.126, CF location CA). The domain was registered on 2026-04-05 via Cloudflare, Inc., and uses a Google Trust Services certificate issued by WE1, which does not mitigate the observed malicious behavior. The page title "Abraxas Wallet – Secure Crypto Management for the Future" aligns with the listed scam type "Wallet/Seed Phishing" and the broader threat classification of a crypto drainer. Gridinsoft assigns a trust score of 0/100, and the domain appears on one security blocklist. VirusTotal reports a single positive detection out of 94 scanners, and PhishDestroy has already blocked the domain. The presence of Cloudflare nameservers (alaric.ns.cloudflare.com, georgia.ns.cloudflare.com) suggests the operators are leveraging a reputable CDN to obscure origin. No additional payload or code analysis is available, so the exact mechanism for draining cryptocurrency (e.g., malicious wallet scripts or seed‑harvesting forms) remains unconfirmed. Defenders should treat the domain as high‑risk: enforce URL filtering to deny any request to the domain, add the IP address to network block lists, monitor DNS queries for the domain and its nameservers, and consider sinkholing the host to capture further activity. Continuous re‑scanning with multiple anti‑malware engines is advised to detect any emerging indicators.