xn--v-7sbav[.]xn--mhbrwllts-0yhacc6e7ff4aao02bk4jha9831ndajh[.]bluelwallet[.]eu[.]com

The domain xn--v-7sbav.xn--mhbrwllts-0yhacc6e7ff4aao02bk4jha9831ndajh.bluelwallet.eu.com was created on February 21, 2026 and is currently taken offline. Infrastructure analysis shows it resolves to the IPv6 address 2606:4700:3036::ac43:b8e2, which is advertised by AS13335 Cloudflare, Inc. in the United States. The site used a Let’s Encrypt/E7 TLS certificate, confirming the presence of HTTPS, and the service fingerprint identified Cloudflare with HTTP/3 support. The domain is registered through Instra Corporation Pty Ltd and uses the centralnic.net name server set (ns1‑ns4.centralnic.net).

In threat intelligence, the domain appears on a single security blocklist and is specifically blocked by PhishDestroy. VirusTotal recorded a single positive detection out of 93 scanned vendors, reinforcing the suspicion of malicious activity. The page title returned from the site is “Welcome to Aave Delightful Dining,” which does not correspond to legitimate Aave branding and is typical of crypto‑drainer campaigns that lure victims with deceptive hospitality‑related wording.

Evidence from the known intelligence does not provide details on the exact payload or phishing kit, and no further analysis of page content is available. Defenders should continue to monitor for any re‑activation of the domain, enforce blocklisting at perimeter and DNS filtering solutions, and consider adding the IPv6 address to deny‑list rules for Cloudflare‑hosted assets. Given the elevated risk rating, security teams are advised to treat any communications referencing this domain as hostile, to scrutinize outbound traffic for attempts to resolve or contact the address, and to update incident response playbooks with the indicator set that includes the domain, its resolver IP, the Let’s Encrypt certificate fingerprint, and the observed page title.