aave-dappx[.]sh

On 23 July 2026, the domain aave-dappx.sh was observed as part of a brand‑impersonation campaign targeting the cryptocurrency platform Aave. The domain was registered on 8 August 2025 through NiceNIC International Group Co., Limited and is currently offline. DNS resolution points to the IP address 95.129.234.38, which belongs to the autonomous system AS57724 operated by DDOS‑GUARD LTD in Russia. The domain uses Cloudflare name servers bingo.ns.cloudflare.com and leo.ns.cloudflare.com, indicating that traffic is proxied through Cloudflare’s network.

No TLS certificate was found for the host, so HTTPS connections are not available. Threat intelligence shows that the domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service. VirusTotal analysis recorded 14 positive detections out of 95 scanned security vendors, reinforcing the malicious classification. Reputation services assign a Gridinsoft trust score of 0 / 100 and a Scamadviser score of 25 / 100, both reflecting a high likelihood of abusive activity.

The HTTP response yields a page title of “404 Error”, suggesting that the site either serves a default error page or has been taken down after detection. The campaign is labeled as a “Crypto Scam”, implying that the domain may have been used to lure victims into fraudulent cryptocurrency transactions, although the exact payload or luring technique cannot be confirmed from the available data. Defenders should continue to monitor DNS queries for the aave-dappx.sh name and its associated IP range, enforce blocklisting in perimeter defenses, and ensure that any user‑initiated connections to the domain are denied. Because the site is currently offline, ongoing verification of content is not possible; however, the combination of registrar information, hosting location, detection counts, and low trust scores provides sufficient evidence to treat the domain as malicious and to include it in threat‑intel feeds.