avabonus[.]com

avabonus.com is currently flagged as an active generic phishing site with an elevated risk rating. The domain was registered on May 23 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted on the IP address 172.67.147.71, which is associated with Cloudflare’s network (nameservers ivan.ns.cloudflare.com and june.ns.cloudflare.com). VirusTotal has recorded detections from three of ninety‑one scanning engines, indicating that at least a subset of security products recognize malicious behavior. The domain also appears on a public blocklist and is specifically listed by PhishDestroy as a phishing source, reinforcing the suspicion of abuse.

Infrastructure analysis shows no anomalous ASN or country information beyond the Cloudflare hosting, and no SSL/TLS certificate details have been published in the available intelligence. Likewise, Safe Browsing, Open Threat Exchange (OTX) entries, trust‑score metrics, and page‑title data are not presently disclosed, limiting the depth of technical attribution. The lack of publicly visible page content means that the exact lure or credential‑harvesting technique employed by avabonus.com cannot be confirmed at this time. Defenders should treat any traffic to avabonus.com as hostile.

Recommended actions include adding the domain to local deny lists, updating firewall and proxy rules to block both the FQDN and its resolving IP, and ensuring that endpoint protection products are refreshed to incorporate the three VirusTotal detections. Continuous monitoring of the IP address for new associations and periodic re‑scanning of the domain for updated threat intelligence are advised. Organizations that employ email filtering should also flag messages containing links to avabonus.com as malicious, and users should be warned against clicking any unsolicited links that resolve to this host.