sscalping[.]vip

The domain sscalping.vip was registered on March 14, 2026 through Cloudflare, Inc. The authoritative name servers bailey.ns.cloudflare.com and ethan.ns.cloudflare.com resolve the domain to the IPv4 address 102.204.222.8. The IP is announced by AS139923 (ABCCLOUD SDN.BHD.) and geolocates to Japan. An HTTP GET to the root URL returns a 200 status and the page title “Scalping”. The site is currently active. Infrastructure analysis shows the web server runs Nginx with HTTP/3 enabled and enforces HTTP Strict Transport Security (HSTS). Front‑end assets are built with Vue.js, indicating a modern JavaScript framework. All traffic is terminated behind Cloudflare’s edge network, which also provides DNS resolution and DDoS mitigation. No additional hosting providers are observed. Threat intelligence flags sscalping.vip as a high‑risk cryptocurrency impersonation targeting the Aave brand. Google Safe Browsing classifies the site under “SOCIAL_ENGINEERING”. Six of ninety‑five VirusTotal scanners have raised detections, and the domain appears on three independent blocklists, including PhishDestroy, MetaMask, and SEAL. The site’s content, combined with the “Scalping” title, suggests a scheme to lure Aave users into illicit token swaps or fee‑free trades. Defenders should block all connections to sscalping.vip at network perimeter and add the IP 102.204.222.8 to deny lists. Endpoint security policies must flag any URLs containing the domain and alert users attempting to interact with Aave‑related services. Continuous monitoring of Cloudflare DNS changes is advised, as the attacker could switch behind the same name servers. Incident response teams should treat any credential or wallet information disclosed by victims as compromised and advise affected users to rotate keys and report the theft.