rewards-aave[.]xyz

rewards-aave.xyz was registered on May 18 2026 through Dynadot LLC and immediately began serving content that returns an HTTP 302 response. The site presents the page title “GHO | Aave”, which aligns with the declared brand target of Aave and the impersonation scam classification. The domain’s age of less than two months, combined with a high‑risk rating, suggests a purposeful launch to exploit the Aave brand’s recognition. Network analysis shows the domain resolves to 172.67.128.93, an IP address associated with a Canadian content‑delivery network. The SSL certificate is issued by Let’s Encrypt (E7), indicating the use of a freely available certificate authority. Nameserver records point to rayne.ns.cloudflare.com and trey.ns.cloudflare.com, confirming reliance on a third‑party DNS service. No additional infrastructure such as dedicated hosting or unusual ports is observed. Open‑source intelligence places the domain on four security blocklists and records a single detection by VirusTotal out of 95 scanned engines. AlienVault OTX lists the domain in one threat pulse, and commercial detection platforms PhishDestroy, MetaMask, ScamSniffer, and SEAL have all flagged it as malicious. The page title referencing “GHO”, a known Aave token, reinforces the claim that the site is attempting to masquerade as an official Aave resource, a classic brand‑impersonation technique. Defenders should treat any traffic to rewards-aave.xyz as hostile. Blocking the domain at perimeter firewalls, DNS resolvers, and proxy layers is recommended. Security teams should monitor for outbound connections to the associated IP address and correlate any authentication attempts to Aave services with this indicator. Continuous re‑evaluation is advised, as the site remains active and may evolve its payload or delivery mechanisms.