liable-sapphire-mlrygix5z0-tkzdrbsmyu[.]edgeone[.]app

Analysis of liable-sapphire-mlrygix5z0-tkzdrbsmyu.edgeone.app indicates it was a fraudulent domain hosting a fake cryptocurrency airdrop scam targeting Aave users. The domain, created on February 21, 2026, resolved to IP address 43.152.26.58 (AS139341 ACE, Germany) and was flagged by 3 of 93 security vendors on VirusTotal as malicious. The page title, 'Aave | New Year's Eve Mega Airdrop 2026 – Claim Your Share,' explicitly advertised a non-existent promotion, a common tactic in airdrop scams to lure victims into disclosing wallet credentials or transferring funds. Infrastructure analysis reveals the use of Cloudflare and cdnjs, technologies often leveraged to obscure hosting origins and evade detection.

The domain was registered through MarkMonitor, Inc., and secured with a DigiCert OV SSL certificate, which may have contributed to its initial appearance of legitimacy. As of July 24, 2026, the domain returns an HTTP 404 status, suggesting it has been taken offline, though defenders should note it remains listed on at least one security blocklist. The Gridinsoft trust score of 0/100 further corroborates its malicious classification.

No evidence links this domain to the legitimate Aave protocol or its official communications. Defenders are advised to block the domain and its associated IP at the network level, monitor for residual DNS queries, and alert users who may have interacted with the site prior to its takedown. Given the use of a recognized phishing kit (Airdrop Scam), similar domains may emerge; proactive hunting for domains with comparable naming patterns or infrastructure is recommended.