aztec[.]fund

This domain is flagged as an elevated-risk brand impersonation threat specifically targeting Ethereum users. Analysis indicates the site was designed to mimic legitimate token claim or airdrop portals, a tactic commonly employed to distribute crypto drainers or harvest wallet credentials. The page title, 'Aztec Claim Tokens & Airdrop Portal — Aztec Token Sale Access,' reinforces the deception by presenting itself as an official Ethereum-associated service, despite no affiliation with the genuine Aztec protocol or Ethereum Foundation. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain aztec.fund resolves to IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335) in the United States. It was registered on December 7, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Security vendor detections on VirusTotal report 18 out of 95 engines flagging the domain as malicious. The domain appears on two independent security blocklists, and its SSL certificate is issued by WE1, a low-trust provider often linked to fraudulent sites. The combination of recent registration, brand impersonation, and low detection thresholds suggests a deliberate and targeted campaign. Mitigation measures should prioritize user education and technical controls to counter crypto-specific threats. Organizations and individuals should block resolution to 188.114.97.3 at the network level and update endpoint protection rules to classify aztec.fund as a confirmed malicious domain. Users should be advised to verify token claims or airdrops exclusively through official Ethereum or project channels, using direct links from verified social media accounts or documentation. Wallet software should be configured to warn against or block interactions with domains registered within the last 30 days, particularly those impersonating blockchain protocols. Transaction simulation tools or sandboxed environments are recommended for evaluating untrusted crypto interactions.