aave-paperwalet[.]xyz

This domain, aave-paperwalet.xyz, is actively impersonating the Aave decentralized finance protocol as part of a brand impersonation scheme. Registered on May 29, 2026, through TLD Registrar Solutions Ltd, the domain currently resolves to the IP address 164.215.103.129, hosted by a provider in the Netherlands. Infrastructure analysis reveals that the site is flagged by three security blocklists, including PhishDestroy, MetaMask, and SEON’s SEAL, indicating confirmed malicious classification by multiple independent detection systems. The domain’s Gridinsoft trust score is 0 out of 100, further corroborating its fraudulent nature. The site presents itself under the misleading title 'Hyperliquid CopyTrader — Paper-trade Hyperliquid's top performers,' which does not align with Aave’s core product offerings. This discrepancy suggests an attempt to deceive users by mimicking legitimate trading or wallet services while exploiting Aave’s brand recognition. The domain uses a Let’s Encrypt SSL certificate (YR1), which, while providing HTTPS encryption, is commonly abused by threat actors to lend a false sense of legitimacy. A VirusTotal scan shows that 5 out of 95 security vendors have flagged the domain as malicious, providing additional evidence of its harmful intent. Defenders should note that the domain remains active as of July 12, 2026, and continues to pose a risk to users seeking Aave-related services. The infrastructure, including the hosting provider and IP address, should be monitored for further malicious activity. Organizations are advised to block access to this domain at the network level and include it in endpoint protection rules. Given the high-risk classification and confirmed blocklist presence, no legitimate use case is expected for this domain. Security teams should also investigate whether this domain is part of a larger campaign by analyzing related domains, IP associations, or shared SSL certificates.