survey-aave[.]xyz

As of July 19, 2026, the domain survey-aave.xyz remains an active high-risk phishing infrastructure impersonating Aave, a decentralized finance protocol. Registered through GMO Internet Group, Inc. d/b/a Onamae.com, the domain resolves to 76.223.54.146, an IP address geolocated to the United States and associated with AWS Global Accelerator. Infrastructure analysis reveals the use of nameservers ns5.afternic.com and ns6.afternic.com, alongside a custom verification nameserver (verification-gakbzzzqmt6gkcplw4efpp.ns), which may indicate domain validation mechanisms or defensive evasion tactics. The domain is flagged by 13 of 91 security vendors on VirusTotal and appears in two AlienVault OTX threat intelligence pulses. It is currently listed on three security blocklists and explicitly blocked by PhishDestroy, MetaMask, and SEAL, corroborating its classification as a brand impersonation scam. The SSL certificate, issued by GoDaddy.com (GoDaddy TLS Intermediate CA DV - R1v1), suggests standard encryption practices but does not mitigate the domain's malicious intent. While the exact content of the site remains unanalyzed, the domain's naming convention (survey-aave.xyz) and its designation as a brand impersonation scam strongly indicate an attempt to deceive users into interacting with fraudulent Aave-related services. Defenders should treat this domain as hostile infrastructure and prioritize blocking or monitoring its resolution and associated IP address. Further investigation into the custom nameserver and its potential ties to other malicious domains may yield additional insights into the threat actor's operational patterns.