abrxrx-wallet[.]pages[.]dev

This domain, abrxrx-wallet.pages.dev, is currently under investigation for hosting a crypto drainer phishing infrastructure. Registered on March 30, 2026, through Cloudflare, Inc., the domain resolves to the IP address 188.114.97.3, associated with Cloudflare’s network in Canada. The page title, 'Abraxas Wallet - Secure, Private, and User-Friendly Crypto Wallet,' suggests an attempt to impersonate a legitimate cryptocurrency wallet service, aligning with the identified scam type of wallet or seed phishing. The domain is actively serving content, as indicated by an HTTP 200 status, and employs technologies such as HSTS, Cloudflare, and HTTP/3, which are consistent with modern phishing campaigns leveraging CDN services to evade detection and enhance delivery speed. Infrastructure analysis reveals the domain is proxied behind Cloudflare, utilizing nameservers olivia.ns.cloudflare.com and peter.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services (WE1), a common configuration for domains hosted on Cloudflare Pages. The domain appears on at least one security blocklist, specifically PhishDestroy, though no detections were reported by the 94 vendors that scanned the domain on VirusTotal. The absence of detections does not confirm the domain’s legitimacy, as phishing sites often evade initial scans or are flagged only after prolonged exposure. Defenders should treat this domain as high-risk for crypto-related fraud. The combination of a wallet-themed page title, Cloudflare hosting, and an active HTTP 200 response indicates a live phishing operation targeting cryptocurrency users. Network-level blocking of the domain and its resolving IP (188.114.97.3) is recommended for organizations seeking to mitigate exposure. Further analysis of the site’s content and backend infrastructure is required to determine the full scope of the drainer’s functionality and any associated wallet addresses or malicious scripts.