aave[.]protocol-v3[.]it[.]com

Analysis as of July 25, 2026 indicates that the fully qualified domain aave.protocol-v3.it.com was registered on February 21, 2026. The domain presents a SSL certificate identified as WE1, suggesting the use of a valid‑looking TLS layer. DNS resolution points to IP address 104.21.90.70, which belongs to AS13335 operated by Cloudflare, Inc. and is located in the United States. Infrastructure analysis shows the same hosting provider is frequently abused for rapid deployment of malicious sites.

The domain is currently offline, but historical activity placed it on two security blocklists and it was actively blocked by the PhishDestroy and ScamSniffer filtering services. VirusTotal reports that three of ninety‑five AV engines flagged the domain, providing independent confirmation of malicious intent. The known intelligence tags the site as a crypto‑related scam that impersonates the Aave brand, consistent with the “brand impersonation” threat type. No public Safe Browsing, Open Threat Exchange, or page‑title information is available, and the content of the site has not been captured, leaving the exact phishing payload unknown.

Defenders should add aave.protocol-v3.it.com to DNS‑sinkhole lists, enforce blocklist rules that already reference it, and monitor the associated Cloudflare IP for any future activation. Because the TLS certificate appears legitimate, additional inspection of certificate transparency logs may reveal other domains sharing the same certificate. Continuous re‑query of VirusTotal and other multi‑engine scanners is recommended to detect any changes in detection scores. Organizations that interact with Aave services should treat any unsolicited communication referencing this domain as malicious and should educate users to verify URLs before providing credentials or cryptocurrency transfers.