ronedex[.]com

Analysis of ronedex.com, created on October 27, 2025 and currently taken offline, shows a clear pattern of brand impersonation targeting Aave. The domain resolves to IP address 188.114.96.3, which is hosted by Cloudflare (ASN 13335) and geolocated to the United States. No TLS certificate is presented, meaning the site operates without HTTPS, a common trait of low‑trust malicious infrastructure. The registrar listed is NiceNIC International Group Co., Limited, and the authoritative nameservers are isaac.ns.cloudflare.com and thea.ns.cloudflare.com.

Security intelligence indicates the domain appears on one known blocklist and has been specifically flagged by PhishDestroy. VirusTotal scans report five detections out of ninety‑five antivirus engines, confirming the presence of malicious indicators. Gridinsoft assigns a trust score of 1 out of 100, underscoring the domain’s high risk profile. The page title observed, "RONEDEX: The Easiest Way to Buy Crypto with Confidence," does not reference Aave but aligns with the declared scam type of social media phishing, suggesting the site likely lures victims through deceptive social channels.

Defenders should add 188.114.96.3 and ronedex.com to network blocklists, enforce TLS‑only policies to prevent connections to non‑encrypted endpoints, and monitor for any re‑registration of the domain or similar naming patterns. Continuous threat‑intel feeds should be consulted for updates, and endpoint protection solutions should be configured to recognize the five VirusTotal detections associated with this domain. Given the low trust score and lack of SSL, any traffic to this host should be considered hostile and blocked at perimeter and host levels.