avici-money[.]app

The domain avici-money.app was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently resolved to the Cloudflare‑protected address 104.21.71.105 (AS13335, United States). DNS resolution uses the authoritative nameservers cleo.ns.cloudflare.com and vera.ns.cloudflare.com. The site serves a valid SSL certificate issued by Google Trust Services / WE1, enforces HSTS, and supports HTTP/3, indicating a modern web stack that may aid in evading basic network‑level filters.

Detection metrics show that seven out of ninety‑five VirusTotal scanners have flagged the domain, and it is listed on four public blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. The Gridinsoft trust score is 0/100, reinforcing the assessment of high risk. The page title returned by the server is "Avici - Home," though the actual content has not been publicly disclosed, leaving the specific phishing kit or credential‑harvesting mechanisms unknown.

Despite the technical fingerprints that suggest a purposeful phishing campaign, several uncertainty factors remain. The exact brand or service being impersonated is not evident from the limited intelligence, and no visual or functional analysis of the landing page has been performed. Consequently, the precise attack vector—whether it targets credential theft, cryptocurrency wallets, or other assets—cannot be confirmed at this stage.

Defenders should incorporate avici-money.app into URL filtering and DNS block policies, given its active status and confirmed presence on multiple threat‑intel feeds. Continuous monitoring of the associated IP address and associated Cloudflare zones is advised, as the infrastructure could be repurposed for additional malicious domains. Incident response teams should also consider sandboxing any retrieved page content to identify potential payloads and update detection signatures accordingly.