eligibility-aave[.]app

This domain, eligibility-aave.app, is flagged as a high-risk brand impersonation targeting Aave. It was registered on May 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar often associated with malicious domains. The domain resolves to IP 188.114.97.3, which is part of Cloudflare's infrastructure, and uses HTTP/3 and a Let's Encrypt SSL certificate. The page title 'Nur einen Moment…' suggests a German-language waiting page, commonly used in phishing kits to trick users before credential harvesting. VirusTotal shows 5 out of 95 security vendors flagging this domain, and it appears on 2 security blocklists, including PhishDestroy and BLP-Malware. AlienVault OTX lists it in 16 threat intelligence pulses, indicating broad community reporting. The Gridinsoft trust score is 0/100, reflecting high risk. The domain is currently active, meaning it may still be serving phishing content. Defenders should block access to this domain and IP, monitor for related subdomains or variations, and investigate any user interactions that may have occurred. The exact phishing kit used is not yet analyzed, but the combination of brand impersonation, low reputation registrar, and security vendor flags strongly suggests a credential harvesting operation targeting Aave users. Immediate action to block and alert is recommended.