travelosprime[.]com

travelosprime.com is currently active and classified as a high‑risk brand‑impersonation campaign targeting Aave. The site returns HTTP 200 and presents the page title “TRAVELOS PRIME”. Its creation date of 23 November 2021 indicates a multi‑year operation that has persisted despite detection. Infrastructure analysis shows the domain resolves to 199.250.213.153, an address announced by AS22611 (InMotion Hosting, Inc.) located in the United States. The certificate is issued by Let’s Encrypt (R12) and the authoritative nameservers are NS1.FLIGHTWARE‑SERVER.COM and NS2.FLIGHTWARE‑SERVER.COM. Registration was performed through GoDaddy.com, LLC. Threat intelligence sources corroborate malicious activity. AlienVault OTX lists the domain in 13 separate pulses, and it is presently blocked by PhishDestroy and PhishingDB. VirusTotal reports 15 of 95 scanned vendors flagging the domain, while Google Safe Browsing assigns a SOCIAL_ENGINEERING label. The site employs common web‑stack components such as Apache HTTP Server, Bootstrap, reCAPTCHA, jQuery (served from the jQuery CDN), Google Analytics, and a Facebook Pixel. Gridinsoft assigns a trust score of 0 / 100, and the domain appears on two additional security blocklists. Defenders should add travelosprime.com to outbound filtering rules and block resolution of its IP address 199.250.213.153. Monitoring of DNS queries for the associated nameservers and registration details can provide early warning of similar infrastructure reuse. Because the page is confirmed to impersonate Aave, any credential or token capture attempts should be treated as compromised, and affected users must be instructed to rotate credentials and review associated accounts. Continuous threat‑intel feeds should be consulted for updates, as the domain remains active and may evolve its payload or hosting.