avax-trades[.]com

This domain is flagged for elevated-risk brand impersonation targeting Avalanche, a blockchain platform. The threat involves fraudulent replication of Avalanche’s branding and user interface to deceive victims into disclosing credentials or transferring assets under false pretenses. Analysis indicates the domain was specifically designed to exploit trust in the Avalanche ecosystem, as evidenced by its page title, 'Avax-trades || Home,' which mimics legitimate trading or wallet service portals. Infrastructure analysis reveals the domain was registered on May 30, 2025, through GMO Internet Group, Inc. d/b/a Onamae.com. It resolves to the IP address 107.172.61.186 and employs Nginx with OpenResty as the underlying web server technology. Security vendor detections include 4/95 flags on VirusTotal, while Gridinsoft and Scamadviser both assigned trust scores of 1/100 and 0/100, respectively. The domain appears on one security blocklist and is currently blocked by PhishDestroy. At the time of assessment, the domain is offline, though historical activity suggests prior operational status. Mitigation for this threat type requires immediate action from security teams and end-users. Network-level protections should include DNS sinkholing or firewall rules to block resolution of the domain and its associated IP address. Security teams are advised to monitor for indicators of compromise, including the domain, IP, and any related subdomains or URLs. End-users should be educated on recognizing brand impersonation tactics, particularly in the context of cryptocurrency platforms, and encouraged to verify domain authenticity through official channels before interacting with any service claiming affiliation with Avalanche. If credentials or assets were exposed, affected parties should revoke access, rotate passwords, and report the incident to the legitimate platform’s security team for further investigation.