5pfusdjeqipucmpyqcd4p6tv576idbsqkkyo4kc52s6d6fhjwqua[.]arweave[.]net

The domain 5pfusdjeqipucmpyqcd4p6tv576idbsqkkyo4kc52s6d6fhjwqua.arweave.net has been identified as a brand impersonation threat targeting Aave, a decentralized finance protocol. Analysis indicates the domain is currently offline, though it previously hosted content designed to mimic legitimate Aave interfaces, as suggested by the detected page title 'Loading…' and the domain's infrastructure. This activity aligns with broader trends of adversaries exploiting decentralized storage networks to evade traditional takedown mechanisms and lend false credibility to malicious campaigns. Infrastructure analysis reveals the domain resolved to the IP address 212.102.56.179 and was registered through NAMECHEAP INC. The SSL certificate was issued by Let's Encrypt, a common choice for both legitimate and malicious actors due to its accessibility. Detection metrics show the domain was flagged by 3 of 95 security vendors on VirusTotal, and it appears on 2 security blocklists. Technologies detected include CDN77, which may have been leveraged to obfuscate the origin of the malicious content or distribute it more efficiently. The domain's risk level is classified as elevated due to its confirmed impersonation of a high-value financial target and its presence on multiple blocklists. As of the latest assessment, the domain has been taken offline, likely due to intervention by security providers or the hosting infrastructure. However, the threat actor may attempt to re-establish the domain or migrate to a new one using similar tactics. Organizations and users are advised to monitor for domains exhibiting comparable patterns, such as those hosted on decentralized networks, resolving to the same IP range, or impersonating financial platforms. Blocking the IP address 212.102.56.179 at the network level and implementing real-time domain reputation checks can mitigate residual risk. Additionally, users should verify the authenticity of any interface claiming affiliation with Aave by cross-referencing official communication channels and avoiding interaction with untrusted domains.