abaraxx-wllets-clouds[.]pages[.]dev

Abaraxx-wllets-clouds.pages.dev has been flagged as a crypto credential theft domain actively impersonating digital wallet services. This domain leverages Cloudflare Pages to host a fraudulent interface designed to harvest user credentials under the guise of a legitimate wallet service. No known drainer kit signatures are currently associated with this domain, but the structure and naming convention suggest a deliberate attempt to mimic legitimate wallet providers to deceive users into entering sensitive information. Technical indicators reveal this domain resolves to IP 172.66.47.103, registered through Cloudflare, Inc., with a Google Trust Services SSL certificate. As of the latest analysis, VirusTotal reports 0 detections out of 95 scanners, indicating a low detection rate despite its malicious intent. The domain’s creation date remains under review, and no entries have been identified in public blocklists such as Google Safe Browsing (GSB). The absence of detections highlights the stealthy nature of the threat and the need for proactive monitoring. This domain is currently active and under investigation, with no confirmed takedown actions as of this advisory. Users are advised to block access to abaraxx-wllets-clouds.pages.dev and remain vigilant for similar credential harvesting campaigns. The risk remains high due to the domain’s ability to evade detection and its potential to harvest crypto wallet credentials. Organizations should implement network-level blocks and educate users on verifying domain legitimacy before entering sensitive information.