aave-eth-v3[.]org

The domain aave-eth-v3.org was registered on July 15, 2025 through NiceNIC International Group Co., Limited. DNS resolution points to IP address 172.67.154.227, which is owned by Cloudflare, Inc. (AS13335) and is geolocated in the United States. The TLS certificate presented by the site was issued by Google Trust Services under the WE1 intermediate, confirming the use of Cloudflare‑provided SSL. During a brief acquisition the page title returned was “AAVE: Open Source Liquidity Protocol | Lend, Borrow & Earn,” directly invoking the Aave brand and indicating a brand‑impersonation motive.

The site leveraged common front‑end components such as Bootstrap, jQuery, Popper, OWL Carousel, and Cloudflare Browser Insights, and was delivered over HTTP/3. VirusTotal scanning recorded four detections out of ninety‑five participating security vendors, reinforcing a malicious classification. The domain appears on one public security blocklist and has been taken offline after remediation by PhishDestroy. Gridinsoft assigned a trust score of 0 / 100, further confirming its low reputation.

The activity is cataloged as a crypto scam, consistent with the Aave brand reference. No additional page content, login forms, or redirect behavior have been captured, leaving the precise payload or credential‑harvesting technique unknown. Defenders should block the IP address 172.67.154.227 at perimeter firewalls, add aave-eth-v3.org to URL filtering and DNS deny‑list policies, and monitor other Cloudflare‑protected domains for similar brand‑impersonation patterns. Continued surveillance is advised because the underlying hosting provider enables rapid provisioning of look‑alike domains that can target cryptocurrency users.