cjtt3truweg6wifjnnf2yqcin6fk3rkml5xo7jxdidqdmxtmbc4q[.]arweave[.]net

The domain cjtt3truweg6wifjnnf2yqcin6fk3rkml5xo7jxdidqdmxtmbc4q.arweave.net is identified as an elevated-risk brand impersonation threat targeting Aave. This domain is designed to deceive users into believing they are interacting with legitimate Aave services, potentially leading to credential theft or financial loss.

Analysis indicates that the domain has been flagged by 3 out of 95 security vendors on VirusTotal, suggesting a moderate level of detection. The domain is registered through NAMECHEAP INC and resolves to the IP address 79.127.211.89. The SSL certificate is issued by Let's Encrypt, which is commonly used by both legitimate and malicious sites. The domain appears on 2 security blocklists and is currently listed in the Google Safe Browsing database as unsafe. No specific creation date is provided, but the domain has been identified and taken offline recently.

The domain is currently offline, and it is blocked by MetaMask and SEAL, reducing the immediate risk to users. However, the infrastructure and techniques used in this impersonation could be repurposed or reused in future attacks. It is recommended that Aave users only access the official Aave website and verify the URL and SSL certificate before entering any sensitive information. Security teams should monitor for similar patterns and ensure that all known malicious domains are added to their blocklists.