quenthra-haven[.]pages[.]dev

This domain, quenthra-haven.pages.dev, has been identified as a phishing resource engaged in brand impersonation targeting Aave, a decentralized finance protocol. The site is currently offline, though prior analysis confirms its malicious intent through deceptive design elements mimicking legitimate Aave interfaces. The domain was operational long enough to be flagged by security systems but has since been taken down, likely due to enforcement actions or abandonment by the threat actor. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on November 17, 2025, and resolved to the IP address 198.18.1.173, geolocated within the United States under AS13335 (Cloudflare, Inc.). The SSL certificate was issued by Google Trust Services (WE1), a common practice among phishing sites leveraging legitimate certificate authorities to appear credible. Detection metrics indicate the domain was flagged by 17 of 95 security vendors on VirusTotal, while two independent blocklists—PhishDestroy and PhishingDB—listed it as malicious. The page title, 'Suspected phishing site | Cloudflare,' further corroborates its classification as a high-risk resource, though this may reflect post-compromise labeling rather than an original attribute. The current offline status of quenthra-haven.pages.dev suggests mitigation efforts have temporarily disrupted this campaign. However, the infrastructure remains a potential vector for future abuse, particularly given its association with a widely used content delivery network. Organizations and users are advised to maintain blocklist updates, particularly those referencing the domain or its resolved IP address. Security teams should monitor for re-registration attempts under similar naming conventions or infrastructure reuse. End-users are cautioned against interacting with any unsolicited communications referencing Aave or decentralized finance platforms, especially those directing to newly registered or Cloudflare-hosted domains.