app[.]avaae[.]eu[.]com

On 24 July 2026, investigators observed that the domain app.avaae.eu.com was provisioned on 21 February 2026 and subsequently taken offline. DNS resolution points to the Amazon Web Services IP 54.153.56.183, which belongs to ASN 16509 operated by Amazon.com, Inc., and is hosted in the United States. The domain is serviced by the CentralNic name‑server set ns1‑ns4.centralnic.net, and its sole MX record resolves to eu-com-wildcard-null-mx.centralnic.net with priority 0, indicating a placeholder mail configuration rather than a functional mail service. The HTTPS endpoint presented an SSL certificate rated “R10”, and automated trust scoring from Gridinsoft assigned the domain a score of 0 out of 100, reflecting an extremely low reputation.

Web‑page analysis recorded the title “US.COM | The Premium Global Domain for the U.S. Market”, which suggests the site may have been attempting to present itself as a premium US‑focused domain service, though no legitimate brand affiliation is evident. The domain appears on two public blocklists, PhishDestroy and ScamSniffer, confirming that threat‑intel feeds have flagged it as malicious. VirusTotal submissions show that four of ninety‑three scanned security vendors flagged the domain, providing additional independent corroboration of its suspicious nature. Registration data lists Instra Corporation Pty Ltd. as the registrar, but no further registrant details are disclosed.

The current HTTP status is “taken offline”, preventing direct content retrieval at the time of analysis. Because the infrastructure relies on a reputable cloud provider and uses generic CentralNic DNS services, attribution to a specific threat actor remains uncertain. Defenders should continue to block traffic to app.avaae.eu.com at network perimeters, monitor for any re‑appearance of the domain or associated IP addresses, and incorporate the domain’s indicators—such as its IP, name‑server set, and MX record—into threat‑intelligence feeds.