# avkoto.cloud-protect-091.com — SUSPICIOUS

> Stay vigilant: avkoto.cloud-protect-091.com shows signs of phishing activity. Avoid interaction and report suspicious emails immediately.

## Summary
PhishDestroy has identified avkoto.cloud-protect-091.com as a domain potentially involved in generic phishing attacks. Although it is currently classified under an "under investigation" risk level, the domain exhibits characteristics commonly associated with phishing campaigns, warranting caution among users and security professionals alike.

Technically, the domain was registered recently on February 19, 2026, through Hello Internet Corp, pointing to its likely use in a newly orchestrated phishing operation. It resolves to the IP address 104.21.44.49, but no detections have been registered on VirusTotal to date, indicating that traditional security vendors have yet to flag it. Despite zero detections at this time, the domain's suspicious name pattern and recent registration date raise red flags, supporting the ongoing investigation into its intent.

Currently, the domain status remains active, and PhishDestroy recommends users avoid engaging with any communications or websites hosted on avkoto.cloud-protect-091.com. Security teams should monitor this domain closely, update blocklists as necessary, and inform end users about potential phishing risks associated with this threat vector. Continued monitoring and rapid incident response are crucial to mitigating any emerging threats linked to this domain.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 404)
- Page title: GameArena - Boost Your Skill in CS2 & Dota 2

## Domain Intelligence
- Registered: 2026-03-05 13:07:01
- Registrar: Hello Internet Corp
- Country: US
- IP: 104.21.44.49
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["felicity.ns.cloudflare.com", "raina.ns.cloudflare.com"]
- SSL Issuer: Let's Encrypt / E7

## Detection Status
- VirusTotal: 2 vendors flagged
  Vendors: ["Phishing Database", "SOCRadar"]
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["PhishDestroy", "PhishingDB"]

## Evidence
- Screenshot: https://i.ibb.co/cXwktq9r/770a8ff2571e.png
- Cloudflare Radar: https://radar.cloudflare.com/domains/avkoto.cloud-protect-091.com
- Wayback Machine: https://web.archive.org/web/https://avkoto.cloud-protect-091.com
- PhishDestroy: https://phishdestroy.io/domain/avkoto.cloud-protect-091.com/
- LLM endpoint: https://phishdestroy.io/domain/avkoto.cloud-protect-091.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/avkoto.cloud-protect-091.com/
Last updated: 2026-03-19