sso-abraxas-wallet-hub[.]pages[.]dev

The domain sso-abraxas-wallet-hub.pages.dev is currently active and engaged in brand impersonation targeting Aave, a decentralized finance protocol. This campaign presents itself as a cryptocurrency wallet management interface under the title 'Abraxas Wallet - Secure Cryptocurrency Management,' designed to deceive users into disclosing credentials or authorizing malicious transactions. Analysis indicates the domain is explicitly engineered to function as a crypto drainer, siphoning assets from compromised wallets. Infrastructure analysis reveals the domain was registered on September 16, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, geolocated within the United States under AS13335 (Cloudflare, Inc.). The SSL certificate is issued by Cloudflare TLS Issuing ECC CA 3, a common provider for both legitimate and malicious infrastructure. Detection metrics show the domain appears on one security blocklist, while VirusTotal reports a detection ratio of 1 out of 95 security vendors. The low detection count suggests either recent deployment or evasion techniques to minimize initial flagging. As of the latest assessment, sso-abraxas-wallet-hub.pages.dev remains operational and poses a high risk to users. Organizations and individuals are advised to block the domain at the network level and update endpoint protection rules to include this indicator. Users should verify the authenticity of any cryptocurrency-related interface by cross-referencing official sources and avoiding interaction with unsolicited wallet management prompts. Security teams are encouraged to monitor for additional domains registered under similar patterns, particularly those leveraging Cloudflare Pages infrastructure with brand-impersonation themes.