aave[.]ghosmart[.]it[.]com

On July 22, 2026, investigators examined the domain aave.ghosmart.it.com, which is currently offline. The domain was registered on February 21, 2026 and resolves to IP 172.67.205.16, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The TLS certificate presented is identified as WE1, indicating a valid SSL connection at the time of capture. The page title returned by HTTP requests is “Aave – Open Source Liquidity Protocol”, matching the brand target Aave and confirming a crypto‑related impersonation.

The infrastructure has been classified as a crypto scam that impersonates Aave. The domain appears on two independent security blocklists and is actively blocked by PhishDestroy and ScamSniffer. VirusTotal analysis shows the URL was scanned by 95 vendors with no detections; the absence of a detection does not constitute a safety assurance. The limited data set does not reveal any additional malicious payloads, redirect chains, or credential‑harvesting forms, and the site’s HTTP status is not currently observable because the host is offline.

Uncertainty remains regarding the presence of any backend malicious components, the exact phishing kit employed, and whether the domain was ever used to deliver phishing emails or malicious downloads. Defenders should continue to monitor the domain for re‑activation, enforce blocking of the host at the network perimeter, and add the IP address 172.67.205.16 to any existing deny lists. Because the domain impersonates Aave, organizations that use Aave services should educate users about the legitimate Aave URL and encourage verification of TLS certificates. Threat intelligence feeds should be updated to reflect the domain’s status and its association with the crypto‑scam category, and any future traffic to the domain should be logged for forensic correlation.