aave-checker[.]net

The domain aave-checker.net was registered on May 10, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. It is being used to impersonate the decentralized finance platform Aave, presenting itself as a legitimate Aave checking service. Gridinsoft assigns it a trust score of 0 out of 100, indicating a complete lack of reputation.

Infrastructure analysis shows the domain resolves to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. and is geolocated in Canada. The site returns HTTP status code 521, a Cloudflare-specific error that typically indicates the origin server is refusing connections. TLS is provided by a Let’s Encrypt certificate (E8), confirming the use of a free, automated certificate authority.

The domain appears on three security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, reflecting recognition by multiple anti‑phishing entities. AlienVault OTX lists the domain in a single threat‑intel pulse, further corroborating its malicious intent. VirusTotal currently reports 0 detections, a result that likely reflects limited exposure rather than an absence of malicious functionality. The authoritative nameservers magdalena.ns.cloudflare.com and martin.ns.cloudflare.com are both Cloudflare‑managed, a common pattern for rapidly deployed phishing infrastructure.

Defenders should add aave-checker.net to deny‑list rules across DNS, proxy, and email filters, and monitor for any traffic to the associated IP address. Because the site employs a valid Let’s Encrypt certificate, standard certificate‑based trust checks will not flag it, so heuristic or reputation‑based controls are required. Continuous observation of Cloudflare‑hosted domains that mimic Aave branding is advised to intercept future variants.