xn--ve-6kca[.]xn--mppshbrgh-0yhcd7oie7a980aha3153kdaj[.]search-10m-rhonda[.]eu[.]com

This domain, xn--ve-6kca.xn--mppshbrgh-0yhcd7oie7a980aha3153kdaj.search-10m-rhonda.eu.com, is under active investigation as a generic phishing threat targeting the Aave brand, as indicated by its page title 'Aave Plants & Coffee - Where Nature Meets Craft' and classification as brand impersonation. Registered on February 21, 2026, through Instra Corporation Pty Ltd., the domain resolves to IP 172.66.156.179, hosted on Cloudflare's infrastructure (AS13335) in the US. Nameservers are provided by CentralNic, a common configuration for both legitimate and malicious domains.

The site returns an HTTP 200 status, suggesting it is operational, and is currently blocked by at least one security vendor (PhishDestroy). No detections were reported by the 93 vendors scanning the domain on VirusTotal at the time of assessment, though this absence does not confirm safety. The SSL certificate (E6) is valid but provides no inherent trust signal.

Defenders should treat this domain as high-risk due to its active status, brand impersonation classification, and presence on a security blocklist. Immediate actions include monitoring for additional detections, correlating with internal logs for connections to the IP or domain, and preparing for potential takedown if further evidence of phishing is confirmed. The exact content and functionality of the site remain unanalyzed, so defenders should avoid assumptions about specific attack vectors or payloads.