masgrave[.]com

The domain masgrave.com is currently active and is classified as a brand‑impersonation campaign targeting the cryptocurrency platform Aave. The site returns HTTP 200 responses and presents a page title identical to the domain name. No visual analysis is available, but the attribution to Aave is derived from the intelligence feed indicating the brand target. Infrastructure analysis shows the domain was registered on 10 January 2025 through Hostinger Operations UAB. Authoritative name servers are ns1.dns‑expired.com and ns2.dns‑expired.com, both of which are commonly associated with low‑cost or expiring registrations. The domain resolves to IP address 103.224.182.213, which is geo‑located to the United States and is owned by Trellian Pty. Limited. A Let’s Encrypt R12 certificate secures the site, confirming the presence of valid TLS encryption. Reputation signals are strong: VirusTotal records 15 out of 95 security vendors flagging the domain as malicious, and the Gridinsoft trust score is 0 out of 100. The domain appears on one public security blocklist and has been blocked by PhishDestroy. These indicators collectively raise the risk rating to high, consistent with the active status and the brand‑targeted nature of the campaign. Defenders should add masgrave.com to web‑filter and DNS blocklists, monitor DNS queries for the associated IP, and enforce TLS inspection to detect any credential exfiltration attempts. Incident response teams should treat any traffic to this domain as malicious, especially when correlated with Aave‑related user accounts. Continuous monitoring of newly observed domains using the same registrar or name‑server pair is advised, as the infrastructure pattern may be reused in future campaigns.