aave[.]global

This analysis documents the infrastructure and threat indicators associated with the domain aave.global, which was registered on May 07 2026 through GoDaddy.com, LLC. The authoritative name servers are ns75.domaincontrol.com and ns76.domaincontrol.com, both belonging to GoDaddy’s DNS service. DNS resolution points to IP address 15.197.225.128, an AWS Global Accelerator endpoint located in Canada, and the web server returns an HTTP 301 redirect. The TLS certificate presented is issued by GoDaddy.com under the GoDaddy TLS Intermediate CA DV – R1v1 chain, indicating a legitimate‑looking certificate but not confirming legitimate ownership. The site’s page title, displayed as “📨Create A Ticket”, suggests a ticket‑creation interface but no further content has been captured. Email routing is configured to Microsoft’s Outlook protection service (aave‑global.mail.protection.outlook.com). VirusTotal reports that 1 of 92 security vendors flagged the domain, and AlienVault OTX includes it in a single threat‑intel pulse. The domain appears on one public blocklist and is actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 0/100, reinforcing the malicious assessment. The overall risk rating is high and the campaign is currently active. No additional payload, phishing page screenshots, or credential‑harvesting mechanisms have been observed; analysis is limited to the metadata above. Defenders should add aave.global to URL filtering and DNS block lists, monitor for outbound connections to 15.197.225.128, and enforce TLS inspection to detect any malicious payloads. Email gateways should verify the MX record and consider quarantining messages claiming to originate from this domain. Continuous threat‑intel monitoring is advised to capture any future changes to the site’s content or infrastructure.