app-aeve[.]click

The domain app-aeve.click is currently flagged as a high‑risk generic phishing site. It was registered on 21 February 2026 and remains active as of 12 July 2026. The domain resolves to the Cloudflare‑owned address 188.114.96.3 (AS13335), and all traffic is served through Cloudflare’s network, including support for HTTP/3.

The SSL certificate presented by the site is issued by Google Trust Services under the WE1 designation, indicating the use of a valid public‑key infrastructure despite the malicious intent. The domain is hosted on Cloudflare nameservers carol.ns.cloudflare.com and finley.ns.cloudflare.com, and the underlying web technology stack includes PHP. An HTTP 301 redirect is observed, which is commonly used to forward visitors to a credential‑harvesting page.

Reputation data shows the domain appears on five independent security blocklists and has been flagged by PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. VirusTotal analysis reports four detections out of ninety‑five scans, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious classification. The registration was performed through Tucows Domains Inc., a registrar frequently used for disposable or short‑lived malicious domains.

While the observed infrastructure confirms a phishing operation, the specific target brand or credential‑collection template has not been publicly disclosed, leaving the exact payload unknown. Defenders should add app‑aeve.click to network‑level deny lists, enforce URL filtering, and monitor outbound connections to the 188.114.96.3 address. Continuous re‑evaluation of blocklist entries and periodic rescans of the domain are recommended to capture any changes in its hosting or payload.