aave-portals[.]net

This domain, aave-portals.net, is actively impersonating the Aave decentralized finance platform as of July 12, 2026. Registered on May 7, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to 188.114.96.3, a CloudFlare IP address located in Canada. Infrastructure analysis reveals CloudFlare nameservers (eleanor.ns.cloudflare.com, julian.ns.cloudflare.com) and a Let's Encrypt SSL certificate (E8), which are consistent with legitimate services but frequently abused for phishing operations. The domain currently returns an HTTP 403 status, suggesting either a restricted-access phishing page or a defensive measure to evade detection. Defenders should note that aave-portals.net appears on three security blocklists and is flagged by 4 out of 95 security vendors in VirusTotal. AlienVault OTX has recorded the domain in one threat intelligence pulse, indicating prior malicious activity. The Gridinsoft trust score of 0/100 further corroborates its high-risk classification. While the exact phishing kit or payload remains unconfirmed, the domain's structure and naming convention closely mimic Aave's branding, a tactic commonly employed to deceive users into disclosing credentials or interacting with fraudulent smart contracts. Uncertainties include the specific attack vector, as the HTTP 403 response may indicate a gatekeeping mechanism (e.g., geofencing, user-agent filtering, or CAPTCHA) rather than an inactive campaign. The domain's registration details lack transparency, with no clear attribution beyond the registrar. Defenders are advised to treat this domain as hostile and implement immediate blocking at the DNS, proxy, or endpoint level. Monitoring for related subdomains or IP shifts is recommended, as threat actors often rotate infrastructure to evade detection. Given the domain's recent creation and active status, further malicious activity is likely.