avaxstake[.]com

This domain, avaxstake.com, is flagged as a brand impersonation threat targeting Avalanche, a cryptocurrency platform. Analysis indicates the domain was designed to mimic legitimate Avalanche staking services, likely to harvest wallet credentials and drain crypto assets from unsuspecting users. No specific drainer kit signatures have been confirmed, but the domain structure and branding align with known crypto-phishing tactics observed in similar campaigns. Infrastructure analysis reveals the domain was registered on April 23, 2025, through Isimtescil Bilisim A.S., a registrar based in Turkey. It resolves to the IP address 93.89.226.17 and has been detected by 3 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and is assigned a trust score of 0/100 by Gridinsoft. The page title, "isimtescil.net | Türkiye'nin Domain ve Hosting Lideri | Hoş geldiniz," suggests the domain may have been parked or misconfigured at the time of detection, though this does not diminish its prior malicious intent. As of the latest assessment, avaxstake.com has been taken offline, reducing immediate exposure to users. However, the domain remains registered and could be reactivated or repurposed for further malicious activity. Organizations and individuals are advised to monitor for residual DNS caching, block the domain and associated IP at the network level, and alert users who may have interacted with the site prior to its takedown. Remaining risk is classified as elevated due to the domain's recent creation date and the potential for re-emergence under similar branding.