aaveg[.]xyz

The domain aaveg.xyz was observed on July 12, 2026 and is classified as a high‑risk brand‑impersonation site targeting the cryptocurrency platform Aave. The page title returned by the server is “Aaveg”, and the domain is explicitly listed as impersonating Aave. The threat type is recorded as brand_impersonation with a cryptocurrency scam focus.

Infrastructure analysis shows the domain was registered on March 02, 2025 through Go Daddy, LLC and uses the GoDaddy.com, Inc. / Go Daddy Secure Certificate Authority - G2 SSL certificate. Authoritative nameservers are ns07.domaincontrol.com and ns08.domaincontrol.com. The site resolves to IP 76.76.21.98, an address owned by Amazon.com, Inc. (AS16509) located in the United States. Hosting technology includes Vercel and the site enforces HTTP Strict Transport Security. Google Analytics scripts are detected, indicating tracking capability. The HTTP response is a 301 redirect.

Reputation signals are mixed: the domain appears on a single security blocklist and has a Gridinsoft trust score of 0 out of 100, indicating a negative assessment. VirusTotal scans show that 2 of 95 security vendors flagged the domain, while the remaining vendors did not issue a detection. PhishDestroy has already blocked the domain. No public content analysis is available, so the exact phishing page layout, credential collection mechanisms, or malicious payloads have not been verified.

Defenders should treat aaveg.xyz as hostile infrastructure. Immediate actions include adding the domain to network‑level deny lists, updating endpoint protection signatures, and monitoring DNS queries for the associated IP and nameservers. Because the domain leverages legitimate SSL and a reputable hosting provider, additional heuristic detection based on brand‑impersonation patterns and rapid redirection behavior is advised. Continuous re‑evaluation is recommended in case further indicators emerge.