avantisfii[.]com

On 25 July 2026, the domain avantisfii.com was observed hosting a high‑risk crypto‑scam campaign. The site returns an HTTP 301 redirect and serves content over Cloudflare’s network using HTTP/3. The TLS certificate is issued by Google Trust Services (WE1) and is valid for the host name, which may lend superficial credibility. DNS resolution points to 188.114.96.3, an address owned by AS13335 Cloudflare, Inc., in the United States. Nameserver records list decker.ns.cloudflare.com and priscilla.ns.cloudflare.com, confirming that the domain is fully integrated with Cloudflare’s DNS service. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited.

No further registrant details are publicly disclosed. The page title captured by crawlers reads “Trust and Security in Web3”, suggesting an attempt to attract users interested in blockchain or cryptocurrency services. No additional page content has been disclosed, so the exact phishing lure and credential‑capture mechanisms remain unknown. Reputation services have flagged avantisfii.com. Six of ninety‑three VirusTotal scanners reported it as malicious, and the domain appears on two independent blocklists, specifically PhishDestroy and ScamSniffer. Both blocklists classify the site as a crypto‑scam vector, consistent with the observed scam type.

The presence on multiple blocklists and the multi‑vendor detection indicate a non‑trivial likelihood of malicious activity. Given the current evidence, defenders should block network connections to 188.114.96.3 and add avantisfii.com to local and perimeter deny lists. Security teams should monitor DNS logs for queries to the Cloudflare nameservers associated with this domain and enforce strict content‑filtering rules for any URLs containing the “Trust and Security in Web3” title pattern. Continuous re‑scanning with sandbox and URL analysis tools is recommended to capture any payloads or credential‑stealing forms that may be deployed later.