ava-rpc[.]com

Analysis of ava-rpc.com shows a newly created domain (registered on 2025-11-11) that has been associated with generic phishing activity. The domain is hosted on Cloudflare infrastructure, resolving to IP address 172.67.159.29, which is owned by AS13335 Cloudflare, Inc. and geolocated in the United States. Registration was performed through NiceNIC International Group Co., Limited, and the authoritative name servers are coleman.ns.cloudflare.com and rayne.ns.cloudflare.com, confirming the use of Cloudflare’s DNS services. No SSL certificate is presented for the domain, indicating that the site was served over plain HTTP, a characteristic often observed in low‑cost phishing deployments.

The Gridinsoft trust score of 0 / 100 further reinforces the malicious assessment, as the scoring system rates the domain as entirely untrustworthy. VirusTotal analysis reports that two out of ninety‑five scanning engines flagged the domain, providing independent vendor corroboration of its malicious nature. The domain has been actively blocked by the PhishDestroy service and appears on a single public security blocklist, demonstrating that external threat‑intelligence feeds have already identified it as abusive. Current online status is reported as offline, suggesting that the site has been taken down or is temporarily inaccessible; however, the underlying infrastructure (Cloudflare IP and DNS) remains under the same control and could be re‑activated.

Because no page title, content, or Safe Browsing verdict is available, the precise phishing vector (e.g., credential harvesting page) cannot be described, and the extent of victim impact remains uncertain. Defenders should continue to enforce blocking of the domain at perimeter defenses, monitor the associated IP address for any future activation, and consider adding the domain to internal threat‑intel feeds.