app[.]tradeanzocapital[.]com

This domain, app.tradeanzocapital.com, is flagged as a brand impersonation threat targeting Avalanche, a well-known blockchain platform. Analysis indicates the site mimics Avalanche’s authentication interface, presenting a login page titled 'Sign in - tradeanzocapital' designed to harvest user credentials. The threat type is classified as brand impersonation with an elevated risk level due to its targeted deception of cryptocurrency users. No drainer kit signatures were identified in the available data, though the presence of a credential phishing portal remains a primary concern. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain was registered on February 21, 2026, an unusually future-dated entry that may indicate falsified records or an attempt to evade detection. It resolves to IP address 172.245.155.10, hosted on AS36352 (HostPapa) in the United States. The SSL certificate is issued under the R12 root, a common but not inherently malicious attribute. VirusTotal reports 12 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist and is actively blocked by at least one threat intelligence feed. No Google Safe Browsing (GSB) detections were recorded at the time of assessment. The domain is currently offline, reducing immediate exposure to end users. However, the infrastructure remains registered and could be reactivated with minimal effort. Response actions should include continued monitoring of the domain and IP address for reactivation attempts, as well as dissemination of indicators of compromise (IOCs) to relevant threat intelligence sharing communities. Users who may have interacted with the domain are advised to rotate credentials immediately, particularly those associated with cryptocurrency wallets or exchanges. The remaining risk is classified as elevated due to the domain’s potential for reuse and the persistent threat to Avalanche’s user base.