kasambavesi[.]co[.]zw

This domain, kasambavesi.co.zw, is confirmed to operate as a high-risk brand impersonation phishing site targeting Aave users. The site presents a fake interface designed to harvest credentials or deploy crypto-draining malware, leveraging the trust associated with the Aave decentralized finance platform. The page title, "Netflix," is a deliberate misdirection tactic to obscure its true malicious intent, a common technique in phishing infrastructure to evade automated detection systems and mislead victims during initial reconnaissance. Analysis indicates the domain is hosted on IP 41.191.232.22, located in Zimbabwe under AS37123 (Telecontract Pvt Ltd). It currently holds no valid SSL certificate, a critical omission that exposes all transmitted data to interception. VirusTotal reports 15 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing has explicitly classified it as phishing. The domain appears on two independent security blocklists and is actively blocked by PhishDestroy and PhishingDB, further corroborating its malicious classification. Infrastructure records show the domain was registered through a Zimbabwe-based registrar, though exact creation dates remain unverified. Users who visited kasambavesi.co.zw should immediately revoke any active sessions or connected wallets associated with the Aave platform. All credentials entered on the site must be considered compromised and should be changed across all services where identical or similar passwords were used. Monitor financial accounts and blockchain transactions for unauthorized activity, particularly focusing on outgoing transfers or contract interactions. If crypto assets were exposed, consider migrating funds to a new wallet address and report the incident to relevant blockchain security teams for further analysis. Network-level protections should be updated to include this domain in enterprise blocklists to prevent future access attempts.