aave-defi[.]io

The domain aave-defi.io was registered on February 21, 2026 through Porkbun LLC and is currently taken offline. DNS resolution points to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc., located in the United States. The authoritative name servers are tim.ns.cloudflare.com and nora.ns.cloudflare.com, indicating that the site leveraged Cloudflare’s edge network. HTTPS negotiation presents a certificate issued by Google Trust Services under the WE1 intermediate, confirming a valid TLS chain but offering no indication of legitimate ownership.

HTTP probing returned a 200 status code and the page title "Just a moment...," a generic placeholder often used to hide content behind JavaScript challenges. Detected technologies include Cloudflare Browser Insights, Cloudflare, and HTTP/3, all consistent with the identified hosting provider. The domain received a Gridinsoft trust score of 0 out of 100, the lowest possible rating, and is listed on two security blocklists. Both PhishDestroy and ScamSniffer have flagged the domain, and VirusTotal recorded three positive detections out of ninety‑three scanned vendors.

The intelligence categorizes the activity as a crypto scam that impersonates the Aave brand, suggesting an attempt to lure Aave users into fraudulent interactions. While the site is no longer reachable, the combination of a fresh registration, Cloudflare hosting, a zero‑trust score, and multiple blocklist entries strongly indicates malicious intent. Defenders should continue to block the domain at perimeter defenses, monitor DNS logs for any look‑alike variations, and update brand‑specific threat feeds to include this indicator. Further investigation of related domains sharing the same Cloudflare name servers or IP range may uncover additional infrastructure used for Aave‑related impersonation campaigns.