av-auth-v2[.]app

av-auth-v2.app was observed hosting a page with the title “Success!”. The site was classified as a generic phishing operation and assigned an elevated risk rating. VirusTotal records show that four of ninety‑five scanned security vendors flagged the domain, indicating a non‑trivial detection rate. The domain resolves to the Cloudflare‑owned address 172.67.159.196, which belongs to AS13335 (Cloudflare, Inc.) and is located in the United States. Nameserver delegation points to alex.ns.cloudflare.com and leah.ns.cloudflare.com, confirming that the domain is registered through Cloudflare, Inc. No SSL certificate was presented for the host, meaning the connection is unencrypted and susceptible to interception.

Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single external security blocklist. PhishDestroy also listed the host as blocked, providing additional corroboration of malicious intent. The site’s current status is offline, and the domain has been taken down, which mitigates immediate exposure but does not preclude future re‑use of the same infrastructure. Because the page content beyond the title has not been captured, the specific phishing vector (e.g., credential harvesting form, redirect, or download) remains unknown. Likewise, no brand or targeted service is identified in the available data, limiting attribution of the campaign’s focus.

Defenders should continue to block the domain at the DNS and proxy layers, monitor the associated IP address for any re‑appearance of malicious activity, and add the host to internal blocklists. Given the lack of TLS, any future incarnation of the domain would benefit from enforcing HTTPS and certificate pinning. Ongoing threat‑intel feeds should be queried for new detections, and security appliances should be updated to reflect the four vendor flags reported by VirusTotal.