avatarshop[.]live

Analysis indicates that avatarshop.live is an active phishing domain targeting Russian-speaking users, as evidenced by its page title 'Выберите товар' (Select Product). The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious infrastructure. It resolves to IP address 188.114.97.3, hosted on Cloudflare’s network in Canada, and uses Cloudflare nameservers (gina.ns.cloudflare.com, kurt.ns.cloudflare.com), which are commonly leveraged to obscure hosting origins and evade takedowns. Security vendors have flagged the domain, with 5 of 94 engines detecting it as malicious on VirusTotal. It appears in 8 threat intelligence pulses on AlienVault OTX and is blocked by at least one security blocklist. The domain’s Gridinsoft trust score of 0/100 further supports its classification as high-risk. SSL certification is provided by Let’s Encrypt (serial E7), a common choice for both legitimate and malicious sites due to its low barrier to entry. Technical indicators reveal the use of Bootstrap, jQuery, and Cloudflare Browser Insights, suggesting a structured frontend likely designed to harvest user credentials or payment details. The HTTP/3 protocol is also in use, which may complicate network-based detection efforts. While the exact brand or service being impersonated remains unconfirmed due to the lack of detailed page analysis, the page title implies a retail or e-commerce theme, potentially targeting users under the guise of a shopping platform. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments with Russian-speaking users. Monitoring for connections to the IP 188.114.97.3 and associated Cloudflare infrastructure may help identify related campaigns. Given the domain’s recent registration and active status, further investigation into its hosting provider and registrar is recommended to assess potential takedown avenues.