ambravioxar[.]net

ambravioxar.net was registered on 21 January 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. The domain resolves to 172.67.140.19, an address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. No TLS certificate is present, meaning the site was served without HTTPS and browsers would not display the padlock icon, a common user warning. The HTTP service has been taken offline at the time of analysis, and the page title observed when the site was live reads "Ambravioxar - Plataforma Oficial | Trading IA 2026". The title and the listed scam type identify the operation as a brand impersonation campaign targeting the brand "base".

VirusTotal analysis shows that 14 of 95 scanned security vendors flagged the domain, demonstrating a moderate level of detection across the ecosystem. Independent blocklists have also listed the domain: PhishDestroy, MetaMask, SEAL, and three additional security blocklists, reinforcing its malicious reputation. Google Safe Browsing classifies the URL as a social engineering threat, and Gridinsoft assigns a trust score of zero out of one hundred, indicating a lack of legitimacy. The authoritative nameservers are lennon.ns.cloudflare.com and meiling.ns.cloudflare.com, standard Cloudflare resolver entries.

The recent creation date suggests a short‑lived campaign typical of impersonation attacks, and the use of Cloudflare infrastructure may be intended to obscure the true origin of the malicious content. The combination of a recent registration, lack of TLS, low trust score, multiple vendor detections, and inclusion on blocklists indicates a high‑risk brand‑impersonation operation. Defenders should immediately block ambravioxar.net at network perimeter and DNS layers, add the domain to threat intelligence feeds, and monitor for any resurgence of the service.