aavegotchighst[.]pages[.]dev

Analysis indicates that the domain aavegotchighst.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. The domain resolves to the IP address 172.66.44.189, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. DNS resolution is served by the Cloudflare nameservers rayden.ns.cloudflare.com and nelly.ns.cloudflare.com, and the site employs HSTS and HTTP/3, confirming use of modern Cloudflare infrastructure. The SSL certificate is issued by Google Trust Services under the WE1 identifier, and an HTTP 403 response is returned when the site is accessed, consistent with its current offline status. The page title reported by the scanner is “Checking your connection,” and the domain is explicitly classified as a crypto‑scam that impersonates the Aave brand.

The Gridinsoft trust score of 0 out of 100 reflects a low reputation, and the domain is listed on one security blocklist. PhishDestroy has already taken action to block the domain, and VirusTotal records indicate that one of ninety‑three security vendors flagged the domain, providing additional independent confirmation of malicious intent. Evidence suggests that the primary threat vector is brand impersonation aimed at deceiving users seeking Aave services, potentially to harvest credentials or direct victims to fraudulent crypto transactions. However, the offline status limits immediate observation of any phishing pages, landing pages, or credential‑capture mechanisms, leaving the exact payload unknown.

No visual or functional details have been captured, so the specific tactics employed by the actors remain uncertain. Defenders should continue to block the domain at network perimeter and DNS levels, monitor for any resurgence of the host, and add the IP address 172.66.44.189 to deny‑list policies.