register-aevo[.]pages[.]dev

The domain register-aevo.pages.dev was created on March 14, 2024 and is hosted behind Cloudflare’s network (AS13335) with the IP address 172.66.47.183 located in the United States. The site serves over HTTPS using a Google Trust Services / WE1 certificate and advertises HSTS and HTTP/3 support. Technical fingerprints show the use of Unpkg, SweetAlert2, jsDelivr, crypto-js, and cdnjs libraries, all typical of modern web pages but also common in phishing kits. Intelligence reports identify the page title as "Aevo • Aevo" and classify the infrastructure as employing the Airdrop Scam kit, specifically targeting cryptocurrency users for draining funds. Reputation services assign extremely low scores—Scamadviser 11/100 and Gridinsoft 0/100—and the domain is already listed on three security blocklists, with active blocks from PhishDestroy, ScamSniffer, and Enkrypt. Although VirusTotal has scanned the host with 93 engines reporting no detections, the absence of detections does not confirm safety given the confirmed malicious intent. Defenders should immediately block the domain at the DNS and proxy layers, add the associated IP to network deny lists, and monitor outbound connections for any attempts to resolve or contact the host. Email filtering rules should be updated to flag messages containing references to "Aevo" or similar branding, and SOC analysts should treat any credential or wallet address submissions to this domain as compromised. Continuous monitoring for new sub‑domains or changes in the Cloudflare configuration is advised, as the threat actor may pivot to additional infrastructure.