web-aave[.]xyz

The domain web-aave.xyz was registered on 21 February 2026 and currently resolves to the IPv4 address 163.61.188.222. The host is identified as part of AS153568 NEW DHAKA HARDWARE and is located in the United States. The site presents a valid Let's Encrypt certificate (R13) and serves content over LiteSpeed with HTTP/3 enabled. Nameservers listed are dns1.lytehosting.com through dns4.lytehosting.com.

Risk assessment classifies the site as high. The infrastructure receives a Gridinsoft trust score of 0/100 and is listed on four independent blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. VirusTotal analysis shows that 2 of 95 security vendors have flagged the domain. The page title returned by the HTTP 200 response is “Aave – Open Source Liquidity Protocol”, matching the targeted brand Aave and indicating a cryptocurrency‑related impersonation campaign.

Publicly available intelligence does not include a detailed content scrape, so the exact nature of the user‑facing page—whether it hosts credential‑stealing forms, malicious redirects, or download links—remains unknown. Registration details point to Cosmotown Inc as the registrar, but no further attribution to the operators has been uncovered. The presence of a legitimate TLS certificate does not mitigate the malicious intent inferred from the brand targeting and blocklist listings.

Defenders should proactively block web-aave.xyz at DNS and proxy layers, and consider adding the associated IP address 163.61.188.222 to network‑level deny lists. Monitoring for additional domains that resolve to the same nameservers or IP range is advised, as the same hosting infrastructure may be reused for parallel campaigns. Email and web traffic filtering should be configured to flag any outbound connections to this domain, and incident response teams should treat any user reports involving Aave‑related URLs as high priority.