app-avea[.]com

Analysis of app-avea.com shows a short‑lived domain that was created on August 25, 2025 and subsequently taken offline. The domain resolves to IP address 104.21.48.1, which belongs to Cloudflare (AS13335) and is geolocated in the United States. DNS configuration lists albert.ns.cloudflare.com, harmony.ns.cloudflare.com and a placeholder entry "null" as authoritative name servers, indicating reliance on Cloudflare’s infrastructure. Registration was performed through OwnRegistrar, Inc., and no SSL certificate was presented at the time of observation, leaving the site exposed to unencrypted traffic.

The page title returned by the server is "Bot Verification," a common tactic used to force visitors through a verification step before delivering malicious content. Malware scanning on VirusTotal recorded detections from 2 of 95 security vendors, reinforcing the malicious nature of the host. Independent security services—including PhishDestroy, ScamSniffer, Polkadot, Enkrypt and Codeesura—have all blocked the domain, and it appears on five additional blocklists, reflecting a consensus among threat intelligence providers that the site is hostile. The infrastructure appears to have deployed the publicly available "Airdrop Scam" phishing kit, and intelligence tags the operation as an investment‑focused scam, consistent with the observed kit’s typical use of false investment offers.

Gridinsoft’s trust scoring system assigned a score of 0 out of 100, indicating a complete lack of trustworthiness. Although the site is currently offline, defenders should continue to monitor the associated IP address (104.21.48.1) for any re‑use, enforce outbound filtering for the domain and related hostnames, and ensure that URL filtering solutions reference the blocklists that have already listed the domain. Network traffic to Cloudflare edge nodes originating from internal assets should be scrutinized for anomalous patterns, especially any attempts to retrieve the "Bot Verification" page.