app[.]aveae[.]eu[.]com

The domain app.aveae.eu.com is a phishing site engaged in brand impersonation, specifically targeting users of x.com. This scam operates as a credential-harvesting page designed to deceive victims into entering login details under the false pretense of legitimacy. No crypto drainer kit was identified in this campaign. As of the latest verification, app.aveae.eu.com has been taken offline, though prior activity remains a concern for those who may have interacted with it.

Technical analysis reveals that app.aveae.eu.com was flagged by 2 of 95 security vendors on VirusTotal, including alphaMountain.ai and Fortinet. The domain was registered through Instra Corporation Pty Ltd. on February 21, 2026, and resolved to the IP address 67.217.228.227, hosted in the US under AS399629 BL Networks. It appeared on 2 security blocklists, PhishDestroy and ScamSniffer, and had no SSL certificate, resulting in a Gridinsoft trust score of 0/100. The observed page title was 'Welcome to nginx!', and MX records pointed to eu-com-wildcard-null-mx.centralnic.net. Nameservers included ns1.centralnic.net, ns2.centralnic.net, ns3.centralnic.net, and ns4.centralnic.net.

Victims of app.aveae.eu.com should immediately change passwords for any accounts accessed through the site, particularly for x.com, and enable two-factor authentication if not already active. Monitor accounts for unauthorized activity and report any suspected fraud to the impersonated brand. To prevent further exposure, users can report the domain to their security software provider or submit it to platforms like Google Safe Browsing or PhishTank for broader awareness and blocking.