gov-aavepro[.]xyz

Analysis of gov-aavepro.xyz indicates the domain was registered on August 02, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The authoritative name servers are hazel.ns.cloudflare.com and lex.ns.cloudflare.com, confirming that the zone is hosted behind Cloudflare’s network. DNS resolution points to the IP address 172.67.210.217, a Cloudflare edge node that supports HTTP/3. The domain appears on three independent security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the classification as a high‑risk phishing infrastructure.

Threat intelligence from AlienVault OTX records a single pulse referencing the domain, and VirusTotal scans report that five of ninety‑one security vendors have flagged the host as malicious. The limited vendor count suggests that detection signatures are still propagating, but the presence of multiple independent blocks demonstrates a consensus view of malicious intent. No additional forensic artifacts such as SSL certificate details, page title, or content snapshots are publicly available at this time, leaving the exact phishing payload unknown.

Defenders should continue to deny any network traffic to 172.67.210.217 associated with gov-aavepro.xyz, enforce blocklist updates, and monitor for newly observed indicators that may arise from credential‑stealing campaigns targeting users of the affected services. Ongoing surveillance of the domain’s DNS configuration and any changes to its hosting posture is recommended, as rapid redeployment is common in active phishing operations.