zeusexchange[.]vip

Analysis of zeusexchange.vip, observed as of July 24, 2026, shows a domain created on February 27, 2025 and registered through NameSilo, LLC. The site resolves to IP address 172.67.220.87, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The domain is fronted by Cloudflare name servers kimora.ns.cloudflare.com and santino.ns.cloudflare.com, and no SSL certificate is presented, indicating an unencrypted HTTP service. The page title returned from the host is "Home | Zeus AI," and the campaign is classified as a Fake Exchange operation that impersonates the Aave brand.

VirusTotal scans report that four of ninety‑five security vendors flagged the domain, providing a modest detection signal. AlienVault OTX lists the domain in one threat‑intel pulse, and it appears on a single external blocklist, where it has been actively blocked by PhishDestroy. Gridinsoft assigns the domain a trust score of 1 out of 100, reflecting an extremely low reputation.

The domain’s current operational status is offline, yet historical activity suggests it was used to lure victims under the pretense of a cryptocurrency exchange. Defenders should continue to monitor for residual indicators of compromise linked to the IP range and Cloudflare infrastructure, enforce outbound traffic controls to block connections to zeusexchange.vip and its associated IP, and update web filtering and intrusion detection signatures to include the domain and its observed characteristics. Given the elevated risk rating and brand impersonation, security teams should advise users to avoid any unsolicited communications referencing Aave that direct to this domain or similar variants.