avaxlabs[.]pages[.]dev

The domain avaxlabs.pages.dev is currently active and classified as a brand impersonation phishing threat targeting Avalanche, a blockchain platform. The page presents itself under the title 'Wallet Rectify - Rectification, Synchronization, and Validation,' designed to deceive users into interacting with fraudulent wallet services. Analysis indicates this infrastructure is specifically crafted to mimic legitimate Avalanche wallet operations, increasing the likelihood of credential theft or unauthorized transactions. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on March 03, 2025, and resolves to the IP address 172.66.44.64, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging Cloudflare's services. Security vendor detections on VirusTotal report 12 of 95 engines flagging the domain as malicious, while it appears on one security blocklist. The domain's hosting provider and recent registration suggest an attempt to exploit trust in the targeted brand while maintaining operational anonymity. As of the latest verification, avaxlabs.pages.dev remains active and poses a high risk to users unfamiliar with Avalanche's official domains. Organizations and individuals are advised to block access to this domain at the network level and update endpoint protection rules to include this indicator. Users should be educated to verify domain authenticity before entering credentials or connecting wallets, particularly when prompted by unsolicited messages or redirects. Monitoring for additional domains registered under similar patterns (e.g., Cloudflare Pages with blockchain-related keywords) is recommended to preempt further impersonation attempts.