aavedropslive[.]xyz

Analysis of aavedropslive.xyz shows a newly registered domain (creation date February 21 2026) that has been used to impersonate the Aave brand in a crypto‑focused scam. The domain resolves to IP 172.67.207.124, an address belonging to AS13335 Cloudflare, Inc. and geolocated to the United States. DNS queries reveal the authoritative nameservers thea.ns.cloudflare.com and yew.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. The site presents the HTTP title "Just a moment...", indicating the presence of a Cloudflare challenge page but providing no further content for analysis.

SSL termination is performed by Google Trust Services under the WE1 certificate, a common configuration for domains hosted behind Cloudflare. Registration data shows the registrar as NiceNIC International Group Co., Limited; no additional registrant details are publicly visible. Security vendors have flagged the domain on VirusTotal, with five of ninety‑three scanners reporting malicious activity, and the domain appears on at least one external blocklist. PhishDestroy has also listed the site as blocked.

Current status is offline, suggesting the malicious page has been taken down or is no longer serving content. While the available evidence confirms brand impersonation aimed at crypto victims, the exact payload, phishing pages, or credential‑stealing mechanisms remain unknown due to the lack of page content. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated Cloudflare nameservers, and add the IP address to threat‑intel feeds. Ongoing observation of the registrar and any re‑registration attempts is advised, as the threat actor may reuse the same infrastructure for future campaigns targeting Aave users.