safechaininvestments[.]xyz

Analysis as of July 24, 2026 indicates that the domain safechaininvestments.xyz is currently offline but retains several indicators of malicious infrastructure associated with a brand impersonation campaign targeting Aave. The domain was registered on March 15, 2025 through OwnRegistrar, Inc., and resolves to the IP address 23.239.110.100, which belongs to AS53850 GorillaServers, Inc. in the United States. DNS configuration lists three authoritative name servers – ns1.vastgig.com, ns2.vastgig.com, and ns3.vastgig.com – with a null entry, and an MX record pointing to park-mx.above.com with priority 10, a pattern frequently observed in disposable or parked mail setups used by fraud operators. The site presented the page title “Safe Chain Investments - Trading for everyone”, suggesting a crypto‑investment narrative, and the SSL certificate is issued by Let’s Encrypt (R13), a free certificate authority often employed to lend legitimacy to malicious sites.

Reputation checks show a Gridinsoft trust score of 0 out of 100 and the domain appears on four security blocklists. VirusTotal scans have flagged the domain by three of ninety‑three vendors, and it is actively blocked by threat‑intel feeds including PhishDestroy, Polkadot, Enkrypt, and Codeesura. The observed characteristics – low trust score, blocklist presence, and short‑lived registration – align with the reported scam type of a crypto scam impersonating Aave. What remains uncertain is the exact content served before the takedown, as the site is offline and no page capture is available.

Defenders should continue to block the domain at perimeter and DNS layers, monitor the hosting IP for any re‑use, and add the domain to internal watchlists. Additional investigation of the associated name servers and MX host may reveal other related malicious assets. Ongoing vigilance is advised because the infrastructure could be repurposed for future impersonation campaigns.