secure-exxplorer-avalannche[.]pages[.]dev

This domain is under investigation for brand impersonation targeting Avalanche, a blockchain platform. The threat type involves spoofing the Avalanche Explorer interface, likely to deceive users into disclosing credentials or interacting with malicious smart contracts. The page title mimics official branding, explicitly referencing "Avalanche Explorer — Complete Guide, Login & Troubleshooting | Avalanche ®," a tactic designed to exploit trust in the legitimate service. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on April 08, 2026, an unusually forward-dated creation timestamp that may indicate obfuscation. It resolves to the IP address 172.66.47.14, hosted in Canada under Cloudflare’s network. VirusTotal reports zero detections (0/95 engines), suggesting the domain has not yet been widely flagged. However, it appears on one security blocklist and is blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious domains. The use of Cloudflare Pages (.pages.dev) further complicates attribution due to its widespread adoption for hosting static content. Mitigation steps for this brand impersonation threat include immediate domain blacklisting at the network perimeter and endpoint levels. Security teams should monitor for user interactions with the domain, particularly login attempts or wallet connections, which may indicate credential harvesting or crypto drainer activity. Given the zero VirusTotal detections, manual inspection of the site’s content and JavaScript payloads is recommended to identify hidden malicious functionality. Users should be educated to verify domain authenticity by cross-referencing official Avalanche Explorer URLs and avoiding interaction with untrusted variants. Network logs should be reviewed for connections to 172.66.47.14 or related Cloudflare IPs to assess potential compromise.