aave[.]aiweb3[.]top

Analysis of the domain aave.aiweb3.top indicates it is being used for a brand‑impersonation campaign targeting users of the Aave cryptocurrency platform. The domain was registered on February 29, 2024 through NameSilo, LLC and is hosted on Cloudflare infrastructure (ASN 13335) with the IP address 104.21.18.11, which resolves to a United States location. DNS resolution is served by the Cloudflare nameservers aiden.ns.cloudflare.com and jen.ns.cloudflare.com. No SSL certificate was observed for the site, leaving communications unencrypted and increasing the risk of credential interception.

The page title returned by the server is simply "AAVE," matching the intended brand target. Threat intelligence categorises the activity as a crypto scam, and the domain appears on a single security blocklist and has been flagged by PhishDestroy, confirming that at least one external mitigation service has taken action against it. A Gridinsoft trust score of 0 / 100 further reflects the malicious nature of the infrastructure. VirusTotal records show the domain was scanned by 95 antivirus and URL‑reputation engines, none of which reported a detection; this absence of detections should not be interpreted as an indication of safety, as the site’s malicious intent is evident from the other indicators.

The current operational status is offline, suggesting the hosting may have been taken down or the campaign paused. Defenders should continue to block the domain at network perimeter devices, update URL filtering and DNS threat‑intelligence feeds with the observed IP and domain, and monitor for any re‑registration or reuse of the same nameserver configuration. Because the site lacks TLS, any attempt to access it would be exposed to man‑in‑the‑middle interception, so enforcing HTTPS‑only policies will not mitigate this specific threat but will reduce exposure to similar insecure services.