avalanche-tax[.]pages[.]dev

Domain avalanche-tax.pages.dev is flagged for brand impersonation targeting the Avalanche cryptocurrency ecosystem. This site is suspected to host a crypto drainer kit designed to siphon digital assets from unwitting users by mimicking legitimate Avalanche services. The page’s payload and behavior remain under forensic analysis to confirm the exact nature of the drainer framework, which often includes fake wallet connection prompts or fraudulent transaction signing interfaces.

PhishDestroy identifies this domain with the following technical indicators: VirusTotal shows 0 detections out of 95 scanners as of the latest scan. It is registered through Cloudflare, Inc., resolving to IP 172.66.47.13. The domain carries a valid SSL certificate issued by Google Trust Services, which may be used to falsely signal legitimacy. Creation date and broader blocklist status are still being cross-referenced across threat intelligence platforms. The lack of detection suggests either a very recent deployment or evasion tactics leveraging reputable infrastructure providers.

This domain is currently active and under investigation with a status marked as 'under_investigation' in the PhishDestroy database. There are no confirmed takedown actions or blocklist inclusions yet, leaving the risk classified as moderate until further evidence emerges. Users are strongly advised to avoid interacting with avalanche-tax.pages.dev and to verify any Avalanche-related domains via PhishDestroy before entering credentials or initiating transactions. The absence of detection on VirusTotal highlights the need for proactive verification over passive reliance on AV tools.