secure-avalancche-wallet[.]pages[.]dev

The domain secure‑avalancche‑wallet.pages.dev was registered on 2026‑04‑06 and is currently active. DNS resolution points to 188.114.96.3, a Cloudflare‑owned address located in Canada, and the authoritative nameservers are aryanna.ns.cloudflare.com and miguel.ns.cloudflare.com, indicating the site is hosted behind Cloudflare’s edge network. The TLS certificate is issued by Google Trust Services (WE1), confirming the use of a valid HTTPS certificate. The only publicly observable content is the page title "Avalanche Wallet® – Secure Crypto Wallet & Exchange Platform," which directly references the Avalanche brand and suggests a fake exchange scenario. The site is classified as a brand‑impersonation campaign targeting Avalanche users, and the Gridinsoft trust score of 0/100 reflects a high confidence in malicious intent. VirusTotal analysis shows that 1 of 94 security vendors flagged the domain, and the domain appears on a single external blocklist. PhishDestroy has already added the domain to its blocklist, indicating that at least one security community has taken mitigation action. While no payload or credential‑stealing form has been publicly disclosed, the combination of brand‑specific title, fake‑exchange labeling, and low trust score strongly suggests the site is intended to harvest user credentials or private keys. Defenders should block the domain at DNS and web‑filter layers, monitor outbound connections to the associated Cloudflare IP, and consider adding the host to internal blocklists. Continuous re‑scanning is advised to detect any evolution of the site’s content or additional detections from security vendors.