aicryptoguard[.]com

Analysis of aicryptoguard.com indicates that the domain is currently offline but was previously hosting a site titled “AI Crypto Guard – Professional Cryptocurrency Support & Recovery Services.” The domain was registered through NameCheap on August 7 2025 and resolves to the IP address 198.12.66.123, which belongs to AS36352 (HostPapa) in the United States. The SSL certificate presented is identified as “R11,” and the site was flagged by a single security blocklist and by PhishDestroy. Gridinsoft assigned a trust score of 0 / 100, reflecting a lack of confidence in the site’s legitimacy. VirusTotal recorded a detection by one of ninety‑three scanning engines, confirming that at least one vendor identified malicious behavior.

The page title, combined with the supplied intelligence, classifies the operation as a crypto‑related scam that impersonates the Avalanche brand. The registrar, hosting provider, and IP location are all publicly known, providing a clear attribution path for takedown or sink‑hole actions. Evidence does not reveal the specific content or functionality of the site beyond the title, and no additional indicators such as malware hashes, command‑and‑control endpoints, or phishing URLs have been disclosed. Consequently, the precise mechanisms used to defraud victims remain uncertain.

Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor for any re‑appearance of the domain or related subdomains under the same IP range. Threat‑intelligence feeds should be refreshed with the observed attributes—creation date, registrar, hosting ASN, SSL fingerprint, and the single vendor detection—to improve detection of future campaigns that reuse this infrastructure. Organizations using Avalanche services should educate users about unsolicited support or recovery offers referencing the brand, and consider adding the domain to internal watchlists until the hosting provider confirms removal.