yfjvrlkp3qf7plngthgafb5avdthojxenrq4sjghbrd4g2vdlozq[.]ario3[.]arweave[.]io[.]vn

The domain yfjvrlkp3qf7plngthgafb5avdthojxenrq4sjghbrd4g2vdlozq.ario3.arweave.io.vn was registered on May 19, 2026 and is currently active. Infrastructure analysis shows the domain resolves to IP 159.195.49.201, which is allocated to netcup GmbH in Germany (AS197540). The host runs a Ubuntu operating system behind a stack that includes Node.js, Express, Envoy, and Nginx, indicating a typical web‑application server environment. An SSL certificate issued by Let’s Encrypt (E8) is present, confirming encrypted traffic. HTTP requests return a 200 status code, and the page title matches the full domain string, providing no additional context. The site is classified as a brand‑impersonation campaign targeting the Aave brand. It has been flagged by 17 of 91 security vendors on VirusTotal and appears on a single external blocklist. PhishDestroy has already blocked the domain, and the Gridinsoft trust score is 0 / 100, reflecting a high likelihood of malicious intent. Nameserver data could not be retrieved (NS_NOT_FOUND). Defenders should add the IP address and the full domain to network‑level blocklists, monitor DNS queries for the domain, and enforce TLS inspection to detect any payloads. Continuous threat‑intel feeds should be consulted for any emerging indicators related to this infrastructure, and any internal assets that may interact with Aave services should be scrutinized for potential credential harvesting attempts.