interface-aave[.]xyz

interface-aave.xyz is an active domain created on 25 March 2026 and hosted behind Cloudflare infrastructure (IP 188.114.97.3, located in Canada). The domain is registered through Dynadot LLC and uses a Google Trust Services / WE1 SSL certificate. HTTP responses return status 403 and the page title is limited to “Just a moment…”, indicating that content is not publicly rendered. The site is classified as a brand‑impersonation campaign targeting Aave and is described as an investment scam. Infrastructure analysis shows a Gridinsoft trust score of 0/100 and the domain appears in eight AlienVault OTX pulses and three security blocklists, including PhishDestroy, MetaMask and SEAL. The domain resolves to Cloudflare nameservers eleanor.ns.cloudflare.com and jakub.ns.cloudflare.com. No public malware detections have been reported, but the presence on multiple blocklists and the low trust score suggest malicious intent. Defenders should block or monitor DNS queries for the domain and associated IP address, enforce URL filtering, and consider adding the domain to internal threat intelligence feeds. Ongoing observation of any changes to HTTP content or certificate details is advised, as the current 403 response may be altered to serve phishing pages.