avantis[.]money

Analysis as of July 19, 2026 indicates that avantis.money is actively being used for a generic phishing operation and is classified as high‑risk. The domain resolves to the Cloudflare edge address 104.21.68.106, a Canadian‑based infrastructure that is commonly leveraged to hide the true hosting location of malicious sites. DNS resolution is handled by amos.ns.cloudflare.com and pearl.ns.cloudflare.com, confirming the use of Cloudflare’s authoritative name servers. The site presents an HTTP 403 response and a page title of “Just a moment…”, which is typical of Cloudflare’s challenge page, suggesting that the underlying phishing payload is concealed behind a protective layer. The SSL certificate is issued by Google Trust Services under the WE1 intermediate, indicating a valid TLS certificate that may lend credibility to the site. Registration details show the domain was created through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar that does not appear to be directly associated with the observed malicious activity. Threat intelligence flags the domain on a single security blocklist and records a block by PhishDestroy. VirusTotal scans report that 4 of 91 security vendors have flagged the domain, providing additional corroboration of malicious intent. While the exact phishing content and targeted brand are not disclosed in the available data, the combination of a Cloudflare‑proxied IP, a legitimate‑looking certificate, and multiple independent detections strongly supports the phishing classification. Defenders should immediately block avantis.money at network and endpoint layers, add the domain to internal blocklists, and monitor DNS logs for any resolution attempts. Continuous re‑scanning with VirusTotal and other sandbox services is recommended to capture any evolving payloads.