aave-gho[.]com

Analysis indicates that aave-gho.com is an active brand impersonation domain targeting Aave, a decentralized finance protocol. The domain was registered on July 5, 2025, through NiceNIC International Group Co., Limited, and is currently resolving to 188.114.97.3, an IP address assigned to AS13335 (Cloudflare, Inc.) in the United States. The site returns an HTTP 403 status, suggesting access restrictions or a placeholder state, while the detected page title 'Cierpliwości...' may indicate a localized or obfuscated scam operation. Infrastructure analysis reveals the use of Cloudflare services, including Cloudflare Browser Insights and HTTP/3, alongside a Google Trust Services SSL certificate (WE1), which are common among both legitimate and malicious sites. The domain appears in 24 threat intelligence pulses on AlienVault OTX, and one security vendor blocklist flags it, including PhishDestroy. Four of 95 security vendors on VirusTotal detect the domain as malicious, though the specific nature of the threat remains unverified through direct content analysis. Scamadviser assigns a trust score of 20/100, while Gridinsoft rates it 0/100, further supporting its classification as high-risk. The scam type is explicitly labeled as a crypto scam, aligning with the impersonation of Aave’s branding, though the exact mechanics—such as token drainers, fake giveaways, or credential harvesting—are not confirmed. Defenders should treat this domain as active and malicious, particularly in environments involving cryptocurrency or DeFi interactions. Blocking the domain and its resolving IP at the network level is recommended, alongside monitoring for related infrastructure, such as the Cloudflare nameservers (alexis.ns.cloudflare.com, annabel.ns.cloudflare.com). Given the domain’s recent registration and persistent activity, continued vigilance is advised, especially for users or systems associated with Aave or similar platforms.