avtodocs[.]live

The domain avtodocs.live has been identified as a credential theft operation targeting users through deceptive login portals. Analysis indicates the domain is currently offline, though it remains a documented threat in security databases. No specific brand impersonation has been confirmed, but the infrastructure aligns with credential harvesting tactics. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 04, 2026, an unusually future-dated entry suggesting potential registry manipulation. It resolves to the IP address 111.90.157.36 and appears on one security blocklist. VirusTotal reports 8 of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The registrar’s history and the domain’s rapid takedown further indicate suspicious activity. The domain is currently offline, but residual risk persists due to its documented malicious classification. Organizations and users are advised to block the domain and its associated IP (111.90.157.36) at the network level. Monitor for phishing emails or redirects involving avtodocs.live, and verify all login portals via official channels. If credentials were entered on this domain, reset passwords immediately and enable multi-factor authentication on affected accounts.