aave-eligibility[.]xyz

This domain, aave-eligibility.xyz, is actively impersonating the Aave decentralized finance protocol as part of a confirmed phishing operation. Registered on May 7, 2026, through Dynadot LLC, the domain currently resolves to the IP address 104.21.86.15, hosted behind Cloudflare infrastructure in Canada. Analysis indicates the site employs Cloudflare nameservers (ignat.ns.cloudflare.com and summer.ns.cloudflare.com) and presents a 403 HTTP status, suggesting restricted access or deliberate evasion of automated detection. The domain holds a Gridinsoft trust score of 0 out of 100 and appears on three security blocklists, reinforcing its malicious classification. Infrastructure analysis reveals the domain is flagged by multiple security vendors, with five out of ninety-five engines on VirusTotal identifying it as malicious. AlienVault OTX includes the domain in one threat intelligence pulse, further corroborating its association with phishing activity. The SSL certificate, issued by Let’s Encrypt (serial number E7), does not mitigate the risk, as phishing sites commonly use valid certificates to appear legitimate. While the domain’s current HTTP status limits immediate visibility, its registration details and hosting patterns align with known phishing campaigns targeting cryptocurrency users. Defenders should treat this domain as a high-risk threat due to its active status and confirmed brand impersonation of Aave. The domain’s association with Cloudflare infrastructure does not reduce its risk, as threat actors frequently leverage such services to obscure their operations. Organizations should block resolution to 104.21.86.15, monitor for related subdomains or IPs, and alert users to the risk of interacting with any site claiming to offer Aave-related services under this domain. Given its presence on multiple blocklists and detection by security vendors, immediate containment is recommended.