ava-earn[.]com

The domain ava-earn.com was registered on May 23, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active. It resolves to the IP address 188.114.97.3 and uses Cloudflare nameservers eugene.ns.cloudflare.com and kimora.ns.cloudflare.com. VirusTotal has recorded four positive detections out of 91 scanning engines, indicating that multiple security vendors have identified malicious activity associated with the domain.

The domain is listed on the PhishDestroy and ScamSniffer blocklists, and it appears on two additional security blocklists, reinforcing its classification as a phishing resource. No public page title or brand target has been disclosed, so the exact content and the specific brand being impersonated remain unknown. The infrastructure suggests a typical abuse of Cloudflare’s CDN to obscure the origin server, a tactic frequently observed in phishing campaigns.

Defenders should add ava-earn.com to network deny lists, enforce DNS sinkholing where possible, and monitor outbound connections to the associated IP 188.114.97.3. Email security gateways should be updated to flag any messages containing links to this domain, and users should be educated to avoid entering credentials on unknown login pages. Continuous threat‑intelligence feeds should be consulted for any emerging indicators tied to the IP or the Cloudflare nameservers, and incident response teams should treat any traffic to this domain as potentially compromised.