xelvoron[.]xyz

Analysis indicates that the domain xelvoron.xyz was registered on 21 February 2026 via Name.com, Inc. The zone is served by four name servers (ns1kpv.name.com, ns2kry.name.com, ns3jmt.name.com, ns4dmx.name.com) and resolves to the IP address 98.84.224.111, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in Germany. No TLS certificate is present, implying the site operated over plain HTTP. When accessed before being taken offline, the server returned HTTP 200 and presented the page title “Blocklith for Developers – Enterprise‑Grade Web3 APIs,” a title unrelated to the targeted brand.

The domain is explicitly flagged for brand impersonation of Aave and is associated with a wallet/seed phishing campaign that leverages the Wallet Connect abuse kit. Four of ninety‑three VirusTotal scanners flagged the site, and it is listed on three external blocklists, including PhishDestroy, MetaMask, and SEAL. The combination of a recent registration date, use of a reputable cloud provider, lack of TLS, and the specific page title suggests a fast‑flux style deployment aimed at evading early detection while masquerading as a legitimate Web3 development service.

Defenders should add the domain and its resolving IP to denial‑list rules, monitor for any resurgence of the same name servers or similar page titles, and enforce strict validation of TLS for any Aave‑related endpoints. Threat‑intel teams should also track the Wallet Connect abuse kit for reuse in other campaigns and advise users to avoid providing seed phrases to any service that does not present a valid certificate for the Aave brand.