avast-download[.]us

The domain avast-download.us was registered on 21 February 2026 through ENOM, INC. and currently resolves to the IPv4 address 23.254.217.66 hosted by AS54290 Hostwinds LLC in the United States. The authoritative name servers are ns57.hostwindsdns.com and ns58.hostwindsdns.com. No TLS certificate is presented, indicating the site is served over plain HTTP only.

The page title returned by the web server reads "Avast Download – Avast Antivirus Download Software – Avast", which does not match the advertised impersonation target; however, threat intelligence labels the domain as a Facebook brand‑impersonation campaign. The low Gridinsoft trust score of 0 / 100 and the presence on three public blocklists (PhishDestroy, MetaMask, SEAL) further corroborate malicious intent. VirusTotal analysis shows that three of ninety‑three scanning engines flagged the domain, reinforcing the suspicion despite the limited detection count. The infrastructure suggests a typical “host‑and‑serve” model used by opportunistic actors: a recently created domain, generic hosting, and the absence of HTTPS are consistent with rapid‑deployment phishing kits.

Because the site is presently taken offline, direct content inspection is not possible, leaving the exact credential‑stealing mechanisms, payload delivery method, and potential use of redirection unknown. Defenders should nonetheless treat the domain as high‑confidence malicious. Recommended actions include adding avast-download.us to URL filtering and DNS blocklists, ingesting the associated IP address 23.254.217.66 into endpoint and network threat intel feeds, and monitoring for any future re‑registration or similar look‑alike domains that combine "avast" with other brand names. Organizations should also enforce strict HTTPS‑only browsing policies to reduce exposure to sites lacking valid TLS certificates.