app[.]avaee[.]eu[.]com

Analysis of app.avaee.eu.com indicates an elevated‑risk brand‑impersonation campaign targeting Aave users. The domain was registered on 21 February 2026 through Instra Corporation Pty Ltd. and resolves to IP address 188.114.96.3, which is hosted by Cloudflare (AS13335) and geolocated in the United States. The site is currently taken offline, but historical evidence shows it served a page titled "Aave - Open Source Liquidity Protocol," consistent with a wallet/seed phishing kit that seeks to harvest private keys or recovery phrases. SSL information lists a certificate identified as WE1, though no further validation details are provided.

Email infrastructure includes a null MX record (eu-com-wildcard-null-mx.centralnic.net) and four centralnic.net nameservers, suggesting the domain was not intended for legitimate mail exchange. Reputation data shows the domain appears on two security blocklists—PhishDestroy and ScamSniffer—and four of ninety‑three VirusTotal scanners flagged it as malicious. No additional public threat intelligence feeds (e.g., OTX or Safe Browsing) are referenced. Defenders should block the domain and its associated IP at perimeter and DNS layers, add the two blocklist entries to internal deny lists, and monitor for new subdomains under the avaee.eu.com parent zone that could be used in similar impersonation attempts.

Continuous re‑scanning of the IP address is advisable, as Cloudflare infrastructure may host other malicious actors. Given the brand‑targeted nature of the campaign, security teams should also update user awareness materials to warn Aave community members about unsolicited requests for seed phrases that reference the "Aave - Open Source Liquidity Protocol" title. The lack of current hosting limits immediate exploitation, but the infrastructure footprint suggests the operators retain the capability to reactivate or clone the site, warranting ongoing vigilance.