accounts[.]profitpluxfinance[.]com

The domain accounts.profitpluxfinance.com was observed hosting a brand‑impersonation campaign that targets users of the Aave platform. The site’s HTML title reads “ProfitPluxFinance - Trading for everyone”, which does not reference Aave, indicating the page likely attempts to lure victims through indirect messaging rather than direct brand duplication. Registration data show the domain was created on 30 November 2024 through NameCheap, Inc., and it resolves to the IP address 163.61.188.222, which belongs to ASN 153568 (NEW DHAKA HARDWARE) located in the United States. No TLS certificate is present, meaning the site served traffic over plain HTTP, a typical characteristic of low‑cost phishing infrastructure.

The hosting environment uses four LyteHosting name servers (dns1‑dns4.lytehosting.com). Reputation checks reveal a Gridinsoft trust score of 0 / 100 and that the domain appears on a single security blocklist. VirusTotal scans recorded eight detections out of ninety‑five vendors, confirming that multiple security products have flagged the domain as malicious. The domain has been blocked by the PhishDestroy network and is currently listed as offline, indicating that the operator has taken the site down, either voluntarily or as a result of takedown actions.

Because the site is no longer reachable, live content analysis is not possible, and the exact look‑and‑feel of the page remains unknown. Defenders should continue to monitor the associated IP address and name‑server range for re‑use, add the domain and its IP to local blocklists, and consider notifying the registrar to enforce suspension if the domain resurfaces. Threat‑intel feeds that ingest blocklist entries, VirusTotal detections, and the observed registrar information can improve early warning for any future infrastructure that recycles these components.