guiaveiculoonline[.]com

This domain, guiaveiculoonline.com, is flagged as a brand impersonation threat targeting Aave, a decentralized finance protocol. Analysis indicates the site presented itself as an official Aave interface, likely designed to harvest credentials or facilitate cryptocurrency theft. The page title "ESCRITORIO ORIGINAL" suggests an attempt to mimic legitimate login portals, a common tactic in phishing campaigns targeting cryptocurrency users. No specific drainer kit signatures were identified, but the infrastructure aligns with known phishing patterns observed in DeFi-related attacks. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious domains. It resolved to the IP address 188.114.96.3, which is part of a network known for hosting phishing and scam sites. The domain appears on one security blocklist, with a VirusTotal detection score of 5/95 security vendors flagging it as malicious. The SSL certificate was issued by Google Trust Services, a common practice among threat actors to lend legitimacy to phishing sites. No Google Safe Browsing (GSB) listing was recorded, indicating the domain may have been taken offline before broader detection occurred. The domain is currently offline, reducing immediate risk to users. However, the infrastructure remains a potential threat, as domains registered through this registrar and resolving to similar IP ranges have been reactivated in past campaigns. Users who interacted with the site should assume credential compromise and take immediate action, including revoking wallet approvals and monitoring for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts. The elevated risk level is maintained due to the domain's recent activity and the persistent threat posed by similar infrastructure.