xn--ve-6kca[.]xn--mppshbrgh-0yhcd7oie7a980aha3153kdaj[.]vaults[.]co[.]com

The domain xn--ve-6kca.xn--mppshbrgh-0yhcd7oie7a980aha3153kdaj.vaults.co.com was registered on February 21, 2026 and is currently taken offline. Analysis indicates the site was used for a generic phishing campaign that impersonates the Aave Sweets brand, as evidenced by the page title "Aave Sweets - Artisan Dessert Boutique | Premium Cakes & Pastries" and the listed scam type of brand impersonation. The host resolves to the IPv6 address 2606:4700:20::681a:fb4, which belongs to Cloudflare, Inc. (AS13335) and geolocates to the United States. The SSL certificate is rated E6, suggesting a low level of trust.

VirusTotal records show the domain was scanned by 93 vendors with no detections reported, but the absence of detections does not confirm safety. The domain appears on one security blocklist and has been explicitly blocked by PhishDestroy. No additional detection sources such as Safe Browsing, OTX, or other reputation services are referenced. Defenders should treat the domain as a confirmed malicious indicator and incorporate it into URL filtering, DNS sinkhole, and proxy block rules.

Continuous monitoring of the underlying IP address for new hostnames is advisable, as Cloudflare infrastructure can be reused for subsequent campaigns. Given the brand‑targeted nature of the threat, organizations that handle customer communications or payments related to Aave Sweets should increase user awareness and scrutinize any unexpected links or requests that reference the brand. Incident response teams should retain the domain, IP, and page title details for correlation with future phishing attempts and share the indicator with threat‑sharing communities to improve collective defense.