consistent-indigo-zbntuivvn9-wuymg4e86j[.]edgeone[.]app

On 24 July 2026 analysts observed that the domain consistent-indigo-zbntuivvn9-wuymg4e86j.edgeone.app remains active and hosts a page titled “Aave • 2026 New Year Elite Airdrop • Official”. The site was registered on 21 February 2026 through MarkMonitor, Inc. and resolves to the IPv4 address 43.152.26.58, which is allocated to AS139341 ACE in Germany. The TLS certificate is issued by DigiCert, Inc., using a DigiCert Secure Site OV G2 RSA‑4096 SHA‑256 certificate issued in 2022, confirming the presence of a valid HTTPS service that returns HTTP 200 for the landing page. Infrastructure fingerprints show the use of Cloudflare CDN, as well as third‑party libraries from jsDelivr and cdnjs. Nameserver delegation points to ns3.dnsv4.com and ns4.dnsv4.com.

VirusTotal analysis reports that 3 of 95 AV engines flagged the domain, indicating partial detection of malicious activity. The domain appears on one external security blocklist and is listed by PhishDestroy, reinforcing the classification as a crypto‑related phishing operation. Gridinsoft assigns a trust score of 0/100, reflecting a high likelihood of abuse. The identified phishing kit is labeled “Airdrop Scam”, consistent with the page title that attempts to lure victims with a purported Aave New Year elite airdrop. While the available data confirms the presence of a phishing kit and multiple detection signals, no public threat‑intel feeds such as OTX or Google Safe Browsing are referenced, leaving the broader distribution of the malicious URL unknown.

The exact content of the landing page beyond the title has not been captured, so the specific credential‑capture mechanisms remain uncertain. Defenders should block the domain at perimeter firewalls and DNS resolvers, add the IPv4 address to host‑based deny lists, and ensure that any corporate email filters flag messages containing the “Aave 2026 New Year Elite Airdrop” phrase.