genesis-aave[.]com

Analysis of the domain genesis-aave.com indicates a confirmed crypto scam impersonating the Aave brand, with elevated risk due to observable infrastructure and detection patterns. The domain was registered on November 23, 2025, through Dynadot LLC and currently resolves to the IP address 172.67.208.100, hosted on Cloudflare's network (AS13335) in the United States. Nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com further confirm Cloudflare as the DNS provider. At the time of assessment, the domain was offline, though its page title was recorded as 'Aave,' aligning with the reported brand impersonation.

Detection data reveals limited but actionable signals: the domain appears on one security blocklist (PhishDestroy) and is flagged by 7 of 95 security vendors on VirusTotal. No SSL certificate was present, which is atypical for legitimate financial or crypto-related services and may have contributed to detection. The absence of additional blocklist entries or broader vendor detections does not diminish the risk, as phishing domains often evade initial scans before gaining traction. Defenders should treat this domain as malicious based on the combination of brand impersonation, crypto scam classification, and detection by specialized anti-phishing tools.

The use of Cloudflare infrastructure is consistent with threat actors leveraging CDN services to obscure hosting origins, a common tactic in phishing campaigns. While the domain is currently offline, historical resolution to 172.67.208.100 and registrar details provide pivot points for further investigation or blocking. Organizations targeting Aave users or monitoring crypto-related threats should prioritize this domain in threat intelligence feeds and endpoint protections.