aave-foundation[.]xyz

The domain aave-foundation.xyz was registered on February 21 2026 through NiceNIC International Group Co., Limited and is currently listed as taken offline. DNS resolution points to the IP address 188.114.97.3, which belongs to Cloudflare’s network (AS13335) and is geolocated in the United States. The authoritative nameservers ernest.ns.cloudflare.com and uma.ns.cloudflare.com confirm that the domain is hosted behind Cloudflare’s edge infrastructure, with HTTP/3 support detected, indicating a modern web delivery stack. A TLS certificate issued by Google Trust Services under the WE1 signature chain is presented, providing a valid HTTPS connection but offering no assurance of legitimacy.

The page title returned from the site is simply "Aave," matching the targeted brand and reinforcing the classification as a brand‑impersonation campaign. Intelligence sources label the activity as a crypto scam that impersonates Aave, and the domain appears on four external blocklists. It has been flagged by multiple mitigation services, including PhishDestroy, MetaMask, ScamSniffer, and SEAL, reflecting consensus among security vendors that the site is malicious. VirusTotal analysis shows six of ninety‑three scanners reporting detection, further corroborating the risk.

Although the site is offline, its recent creation date, use of reputable hosting, and valid TLS certificate are typical tactics employed to lend credibility to fraudulent operations. Defenders should continue to block the domain at network perimeter and endpoint layers, monitor for any re‑activation or similar domain registrations using the same registrar or naming patterns, and update threat intelligence feeds with the observed indicators of compromise. Evidence gaps remain regarding the exact payload or phishing pages that may have been served before takedown, so continuous observation of the domain’s DNS and certificate status is advisable.