avantisreward[.]center

avantisreward.center was observed hosting a fraudulent token airdrop campaign that mimics the foundation brand. The page title returned by the HTTP response is “$AVNT Token Airdrop | Avantis”, confirming the use of a cryptocurrency‑related lure. Registration data shows the domain was created through Cloudflare, Inc., and the authoritative nameservers are kiki.ns.cloudflare.com and lamar.ns.cloudflare.com. DNS resolution points to IP address 104.21.9.126, which belongs to AS13335 Cloudflare, Inc., and is geolocated to the United States. No TLS certificate was presented, indicating that the site operated without encryption.

Reputation checks reveal a Gridinsoft trust score of 0 out of 100, and the domain appears on two independent security blocklists. It has been explicitly blocked by PhishDestroy and ScamSniffer. VirusTotal analysis recorded seven positive detections out of ninety‑five submitted scanners, reinforcing the malicious classification. The campaign employed the publicly available “Airdrop Scam” phishing kit, a tool commonly used to harvest credentials by promising free token distributions.

The site’s current status is offline, but the historical footprint demonstrates a coordinated attempt to exploit the foundation brand’s reputation. Uncertainty remains regarding any residual infrastructure or whether the attackers have migrated to new domains. Defenders are advised to add the domain and its associated IP range to deny‑list rules, monitor Cloudflare‑hosted assets for similar naming patterns, and enforce strict URL filtering for any URLs containing “airdrop” combined with the foundation brand. Continuous threat‑intel sharing with blocklist operators is recommended to accelerate detection of future replicas.