aavecore[.]xyz

Analysis of aavecore.xyz, observed on July 22, 2026, indicates that the domain is being used for brand impersonation targeting Aave and is classified as a crypto‑scam infrastructure. The domain was registered on March 12, 2026 through NameSilo, LLC and is hosted behind Cloudflare’s network (ASN 13335) with the IP address 172.67.160.214 located in the United States. Nameserver records point to phil.ns.cloudflare.com and stephane.ns.cloudflare.com, confirming the use of Cloudflare’s DNS services. The site presents the generic Cloudflare interstitial page titled “Attention Required! | Cloudflare,” and no TLS certificate is associated with the domain, which suggests that any malicious payload would be served over plain HTTP or via Cloudflare’s edge without a dedicated certificate. Technical fingerprints show Cloudflare Browser Insights, Cloudflare services, and HTTP/3 enabled, consistent with a standard Cloudflare‑proxied site.

Threat intelligence feeds have flagged the domain as a crypto scam; three of ninety‑four VirusTotal scanners flagged it, and it appears on one external blocklist. PhishDestroy has already blocked the domain, and the current operational status is offline, meaning the site is not presently serving content. However, the infrastructure—particularly the use of a shared Cloudflare IP address—could be re‑activated quickly, and the domain’s recent creation date points to a short‑lived campaign lifecycle typical of impersonation attacks.

Defenders should add aavecore.xyz to URL filtering and DNS blocklists, monitor for any re‑appearance of content at the same IP or under the same Cloudflare‑controlled nameservers, and treat any future resolution of the domain as suspicious, especially if it attempts to solicit cryptocurrency transactions or login credentials associated with Aave. Continuous observation of Cloudflare‑hosted IP ranges for similar newly created domains targeting the same brand is advisable.