register-aave[.]xyz

The domain register-aave.xyz has been identified as a phishing site engaged in brand impersonation targeting the decentralized finance protocol Aave. Analysis confirms the domain was actively spoofing Aave's official interface, as evidenced by the page title 'Aave' and the domain's naming convention. The site is currently offline, though its infrastructure remains under investigation for potential re-emergence. Infrastructure analysis reveals the domain was registered through Dynadot LLC on June 28, 2025, and resolved to the IP address 104.18.21.145. Despite its malicious intent, the domain exhibited minimal detection at the time of analysis, with 0 of 95 vendors on VirusTotal flagging it. However, it appeared on one security blocklist and was assigned a trust score of 0/100 by Gridinsoft. The site employed Google Trust Services for its SSL certificate and utilized Google Web Server, HSTS, and HTTP/3 technologies, which may have contributed to its initial evasion of detection. Given the domain's confirmed phishing activity and brand impersonation, users are advised to treat any prior interactions with register-aave.xyz as compromised. Organizations should monitor for related infrastructure, particularly domains registered via Dynadot LLC or resolving to 104.18.21.145, as these may indicate further malicious activity. Blocking the domain at the network level and updating endpoint protection rules to include this indicator of compromise is recommended. Users who accessed the site should revoke any connected wallet permissions and review transaction histories for unauthorized activity.