benqiapp[.]live

Analysis of benqiapp.live indicates that the domain was registered on September 3 2025 through Web Commerce Communications Limited dba WebNic.cc. The authoritative name servers are cesar.ns.cloudflare.com and tegan.ns.cloudflare.com, pointing to Cloudflare’s network (AS13335). DNS resolution returns the IPv6 address 2606:4700:3036::ac43:80b5, which is geolocated to the United States. No TLS certificate is presented; HTTP connections are therefore unencrypted. The site’s HTML title reads “BENQI – Decentralized Finance on Avalanche Network”, suggesting an attempt to associate the domain with the Avalanche blockchain ecosystem.

The listed scam type is “Crypto Scam” and the domain is flagged as impersonating the Avalanche brand. Threat‑intelligence feeds have placed benqiapp.live on a single blocklist, PhishDestroy, which has already taken the domain offline. VirusTotal reports that the domain was examined by 95 scanning engines, none of which raised a detection at the time of analysis. Gridinsoft assigns a trust score of 23 / 100, reflecting a low confidence rating. No evidence of a valid SSL certificate, Safe Browsing entry, or open‑source threat‑intel (OTX) reference is available.

Given the combination of brand impersonation, a low trust score, and inclusion on a phishing blocklist, the domain should be treated as malicious. Defenders are advised to continue blocking the domain at perimeter and DNS filtering layers, monitor for any re‑registration or similar look‑alike domains, and, where possible, enforce TLS inspection to capture any future payloads. Analysts should also update internal threat‑intel repositories with the registration details, name‑server configuration, and the observed IP address to aid correlation with other potential Avalanche‑related abuse campaigns. Until further evidence emerges, the domain remains classified as a crypto‑related brand‑impersonation threat.