savethekids[.]pages[.]dev

Analysis of the domain savethekids.pages.dev shows it is actively used in a high‑risk brand‑impersonation campaign targeting Aave. The site presents a page titled “Fee Distribution Portal” and returns HTTP 200, indicating a fully operational front‑end designed to lure victims. The campaign is classified as impersonation, and the domain is currently listed as active with a risk level of high. Infrastructure investigation reveals that the domain resolves to the Cloudflare‑hosted address 172.66.47.202, which is associated with a Cloudflare, Inc. data center in Canada. The domain was registered on 22 April 2026 through Cloudflare’s registrar service and uses the nameservers ernest.ns.cloudflare.com and ursula.ns.cloudflare.com. TLS is provided by a Let’s Encrypt certificate (E7) and the site enforces HSTS while supporting HTTP/3, confirming modern web‑security configurations. A Gridinsoft trust score of 0 / 100 and a single entry on a security blocklist further underscore its malicious nature. Detection telemetry indicates that the domain has been flagged by one security blocklist and by PhishDestroy, and VirusTotal reports a single vendor detection out of ninety‑five scans. Despite the low detection count, the presence of a brand‑impersonation payload and the high‑risk classification suggest that the domain is part of a targeted phishing operation rather than a low‑volume test. The limited detection may reflect recent deployment, given the domain’s creation date of April 2026. Defenders should treat savethekids.pages.dev as malicious. Immediate actions include adding the domain to network deny lists, configuring email filters to block URLs containing the domain, and monitoring DNS queries for the associated IP address 172.66.47.202. Continuous threat‑intel feeds should be consulted for any emerging indicators, and any internal communications referencing Aave‑related fee distribution should be scrutinized for potential compromise.