xn--ve-6kca[.]xn--mppshbrgh-0yhcd7oie7a980aha3153kdaj[.]gho-vault[.]eu[.]com

The domain xn--ve-6kca.xn--mppshbrgh-0yhcd7oie7a980aha3153kdaj.gho-vault.eu.com was observed hosting content titled "Aave - Open Source Liquidity Protocol," indicating a brand‑impersonation phishing attempt targeting users of the Aave protocol. The domain was created on 21 February 2026 and is registered through Instra Corporation Pty Ltd. Its authoritative name servers are ns1.centralnic.net, ns2.centralnic.net, ns3.centralnic.net, and ns4.centralnic.net. DNS resolution points to IP address 172.67.214.171, which belongs to AS13335 Cloudflare, Inc. in the United States.

SSL certificate information lists the issuer identifier "WE1," confirming that the site employed TLS, though certificate details do not provide additional safety signals. VirusTotal reports that the domain was scanned by 93 security vendors, none of which raised a detection; the report explicitly notes that the lack of detections should not be interpreted as evidence of benign intent. The domain appears on a single security blocklist and is currently blocked by the PhishDestroy service, confirming external recognition of malicious activity.

At the time of reporting (24 July 2026) the site is offline, which limits real‑time content inspection, but the existing metadata already establishes a credible phishing infrastructure. Defenders should add the domain and its associated IP address to network deny lists, monitor for future DNS re‑registration, and enforce email filtering rules that flag messages referencing the Aave brand. Continuous telemetry from DNS sensors and periodic re‑scans of the IP host are recommended to detect any resurgence of the campaign.