chavez-vive[.]com

Analysis indicates that chavez-vive.com is an active infrastructure used to impersonate the Aave brand in a DeFi‑related scam. The site presents a page titled "Sign In" and is listed as a brand‑impersonation threat with a high risk rating. VirusTotal scans have flagged the domain by six of ninety‑five security vendors, and the domain appears on at least one public blocklist. Additional confirmation comes from the PhishDestroy blocklist, which has already flagged the site as malicious.

Infrastructure investigation reveals that the domain resolves to the IP address 94.154.35.60, which is registered to Omegatech LTD under ASN 202412 and geolocated to the Netherlands. The domain was created on June 11, 2025 and is registered through GRANSY S.R.O operating under the SUBREG.CZ designation. DNS is served by a set of five nameservers (ns.gransy.com through ns5.gransy.com). The web server is identified as Nginx, serving content over HTTPS with a Let’s Encrypt R12 certificate, and the site enforces HSTS while supporting HTTP/3. Detected front‑end technology includes Bootstrap, and the HTTP response code is 200, indicating successful content delivery. An MX record is present (mail.chavez-vive.com with priority 10), although no further mail activity is documented. The Gridinsoft trust score of 0 out of 100 reinforces the malicious classification.

Given the concrete indicators—active status, brand‑impersonation intent, observed SSL configuration, and the low trust score—defenders should treat chavez-vive.com as a confirmed high‑risk DeFi phishing host. Network defenses ought to block traffic to the IPv4 address 94.154.35.60 and to the domain itself across DNS, proxy, and endpoint controls. Continuous monitoring of the associated ASN and the registrar's other domains is advised, as the infrastructure may be reused for additional campaigns. Security teams should also share the indicator set with threat‑intelligence platforms to ensure broader community awareness.