avic1-fai[.]com

This domain is flagged as a credential harvesting phishing site with an elevated risk level. Analysis indicates targeted attempts to collect sensitive authentication details through deceptive login portals, a common tactic in financial and corporate credential theft campaigns. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Gname.com Pte. Ltd. and resolves to IP address 188.114.96.3. It appears on three security blocklists and is flagged by 4 out of 95 security vendors on VirusTotal. The site employed a Let's Encrypt SSL certificate and utilized Cloudflare with HTTP/3, suggesting efforts to evade detection and appear legitimate. The page title, http://www.avic1-fai.com, further indicates a lack of professional branding, a red flag for phishing activity. Mitigation requires immediate action from network administrators and end-users. Block the domain and its resolving IP (188.114.96.3) at firewall and DNS levels. Invalidate any credentials potentially exposed to this domain, particularly if users reported interaction with the site. Monitor for similar domains registered through Gname.com Pte. Ltd. or resolving to the same IP range. Organizations should enforce multi-factor authentication and conduct phishing awareness training to reduce susceptibility to credential harvesting attacks.