dghrgpdvcjbxpsdkpa6a5deidmbb24uxzpbdd5susw2d5t2tv5vq[.]arweave[.]net

The domain dghrgpdvcjbxpsdkpa6a5deidmbb24uxzpbdd5susw2d5t2tv5vq.arweave.net was observed delivering a brand impersonation campaign targeting Aave. Infrastructure analysis shows the domain resolves to the IPv4 address 212.102.56.178, which is registered to AS60068 Datacamp Limited and geolocated in Germany. The host is served through the CDN77 platform and uses a Let's Encrypt TLS certificate, indicating a publicly trusted HTTPS endpoint despite the malicious intent. DNS resolution is delegated to Cloudflare nameservers aurora.ns.cloudflare.com and nitin.ns.cloudflare.com, a common pattern for fast‑flux or evasive hosting. An HTTP request to the root returned status code 451, and the page title captured was "Loading…", suggesting the site was either deliberately hidden or in a transient state before being taken offline. The domain is registered via NameCheap, Inc., a registrar frequently abused for disposable or short‑lived malicious domains.

Threat intelligence feeds have flagged the domain on three security blocklists, and it is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a brand impersonation vector. VirusTotal analysis recorded two positive detections out of 91 security vendors, providing additional corroboration of malicious behavior. The combination of a high‑risk IP hosting provider, Cloudflare DNS, and a legitimate SSL certificate creates a plausible surface for unsuspecting victims seeking Aave‑related services.

Uncertainty remains regarding the exact payload or user‑interaction flow, as the captured page title offers no insight into the content served before takedown. No additional indicators such as phishing kits, malicious scripts, or credential‑harvesting forms have been disclosed. Defenders should continue to monitor the IP address 212.102.56.178 for any re‑use, enforce blocklist updates to include the full subdomain, and consider extending detection rules to capture similar arweave.