avaloncapitalltd[.]com

PhishDestroy has identified avaloncapitalltd.com as an elevated-risk domain engaging in brand impersonation of Gmail. This specific threat type involves mimicking the Gmail login interface to steal user credentials, a tactic commonly employed in credential theft campaigns. The domain was created on May 15, 2025, and registered through Atak Domain Bilgi Teknolojileri A.S., and it resolves to the IP address 198.12.66.123. VirusTotal analysis shows only 1 out of 95 security vendors flag this domain, indicating low initial detection. The domain's SSL certificate is R12, and its page title is "1 new message," designed to lure victims into believing they have a new email. It appears on 1 security blocklist and has been taken offline.

To protect against credential theft from Gmail impersonation sites, users should always verify the URL before entering login credentials, enable two-factor authentication on their Gmail accounts, and report any suspicious login pages to Google. If credentials were entered on avaloncapitalltd.com, change passwords immediately and monitor account activity for unauthorized access.