aave-check[.]app

The domain aave-check.app is currently flagged as a high‑risk brand‑impersonation campaign targeting the cryptocurrency platform Aave. Registration records indicate the domain was created on 7 May 2026 and was enrolled through NICENIC INTERNATIONAL GROUP CO., LIMITED. The short‑lived registration aligns with the rapid deployment patterns commonly observed in crypto‑related impersonation operations. Infrastructure analysis shows that aave-check.app resolves to the IP address 188.114.96.3, which belongs to CloudFlare, Inc. and is geolocated in Canada. The authoritative nameservers are ivan.ns.cloudflare.com and laila.ns.cloudflare.com, both associated with CloudFlare's DNS service. The site presents a valid Let’s Encrypt certificate (certificate identifier E8), yet HTTP requests return a 403 status code, indicating that the server is deliberately restricting access to unauthenticated clients. Threat‑intelligence sources corroborate the malicious intent. AlienVault OTX lists the domain in one pulse, and Gridinsoft assigns a trust score of 0 out of 100. VirusTotal reports that four out of ninety‑five scanning engines have flagged the domain as malicious. The domain appears on three public blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL. These detections collectively support the high‑risk assessment. Defenders should incorporate the domain and its associated IP address into outbound‑traffic filtering and DNS sinkhole rules to prevent user exposure. Continuous monitoring of CloudFlare‑hosted IP ranges for similar activity is advised, as the same infrastructure may be reused for other impersonation attempts. Because the public web content has not been analysed, further investigation of the payload and any credential‑ harvesting mechanisms is recommended to fully characterize the campaign.