aave[.]com-protocol-connect-appv3[.]com

The domain aave.com-protocol-connect-appv3.com is currently active and returns HTTP 403 for requests. Infrastructure analysis shows the site is hosted behind Cloudflare, using HTTP/3, and resolves to the IPv6 address 2606:4700:3031::6815:3033, which belongs to AS13335 Cloudflare, Inc. in the United States. The SSL certificate is issued by Google Trust Services under the WE1 hierarchy, indicating a valid TLS handshake despite the malicious intent. Registration data lists MAT BAO CORPORATION as the registrar, with the domain created on 21 February 2026. Nameservers are carl.ns.cloudflare.com and jessica.ns.cloudflare.com. The domain is flagged on two security blocklists—PhishDestroy and ScamSniffer—and receives a Gridinsoft trust score of 0 / 100. VirusTotal reports 5 of 93 scanning vendors flagging the domain, reinforcing the suspicion. The site is categorized as a crypto‑related scam and explicitly impersonates the Aave brand; the only observed page title is “Page Not Found,” suggesting the front‑end content has not been publicly disclosed. Defenders should immediately block the domain at network and endpoint layers, add it to URL filtering policies, and monitor for any related C2 infrastructure or similar domain registrations. Continuous threat‑intel feeds should be consulted for updates, and any email or web traffic referencing the domain should be quarantined for further analysis.