aave[.]vote

The domain aave.vote was observed hosting a crypto‑related impersonation campaign targeting the Aave brand. Technical fingerprinting shows the site was served through Cloudflare’s network (ASN 13335) and resolved to IP address 104.21.56.98, a location associated with the United States. The domain employed Cloudflare’s DNS infrastructure, using the authoritative nameservers kianchau.ns.cloudflare.com and meilani.ns.cloudflare.com, and leveraged HTTP/3 for transport. An SSL certificate issued by Google Trust Services (WE1) was present, indicating a valid TLS layer despite the malicious intent.

HTTP responses returned a 403 status code and the page title displayed only "Just a moment...", suggesting a Cloudflare challenge page rather than a visible phishing interface. The registration record lists Cloudflare, Inc. as the registrar, consistent with the hosting arrangement. Security telemetry indicates the domain appeared on five independent blocklists, specifically PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura, and was classified as a crypto scam that impersonates Aave. VirusTotal analysis recorded ten positive detections out of ninety‑five scanned vendors, reinforcing the malicious assessment.

The site is currently offline, but historical evidence demonstrates a coordinated effort to exploit Aave’s brand reputation. Defenders should continue to block the domain at network perimeter devices, update URL filtering rules to include the listed blocklists, and monitor for any resurgence of the domain or related Cloudflare‑hosted assets. Further investigation is warranted to determine whether additional infrastructure shares the same IP or certificate, which could indicate a broader campaign infrastructure.