Is aave-fi.info a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

Aave-fi.info is a newly registered .info website whose name pairs a recognisable decentralized-finance lending brand term with a "fi" suffix, which positions it as a crypto-finance or DeFi-themed service. The analysis could not extract any readable product, pricing or company content from it. What was observed is a front end that rebuilt itself heavily once interaction began and made many background calls to third-party services, which is typical of a wallet-oriented web application. Its apparent purpose is therefore a DeFi-style interface that invites visitors to interact with digital assets.

Scam/Impersonation Risk

Hard contradictory signals are present. Several major security vendors independently classify the domain as malicious, and a further group rates it suspicious, which amounts to a confirmed blacklist listing. The reputation detections are decisive, and no other signal offsets them. The domain name borrows the vocabulary of an established DeFi lending brand and was registered only very recently. That combination fits the usual pattern of lookalike domains set up to harvest wallet access or funds, although the evidence does not by itself establish which brand, if any, is being copied. In the behavioural sandbox, no wallet-drainer routine, clipboard hijack, hidden form or externally posting password form was detected. The page nonetheless changed its structure extensively after interaction and exchanged a large volume of background traffic with external services, so live content can differ substantially from what a first load shows. Taken together, the site should be treated as a high-risk destination for any wallet connection, login or financial action. The posture is cautionary, not a finding that a particular operator has committed fraud. Evidence:

• Homepage reputation checks: 16 security engines flag the domain as malicious and 2 as suspicious, including several tier-one vendors, and an external kill-switch condition is active.
• Domain provenance: registered 2026-08-07, about 80 days (~0.22 years) old, so the site has no established track record.
• Homepage behaviour: 49 external background requests and 6 external POSTs, all to recognised destinations, and 5,593 page-structure changes after interaction.
• DeFi directory check: the domain does not appear among recognised DeFi protocols, so no TVL or protocol listing supports a claim to represent an established protocol.

Regulatory Verification Notes

The analysis found no regulator registration, licence or authorised-entity listing for the site, and no third-party broker record matched it. Its legal and identity disclosures are unclear. Registrant details are incomplete, which amounts to ownership opacity, and it cannot be tied to a real-world company or individual. This is a verification gap in its own right. The serious concerns arise from the reputation findings above. The domain is registered through NICENIC International Group Co., Limited. Its transport encryption is a standard domain-validated certificate, which proves only that the connection is encrypted and says nothing about who operates the site. Evidence:

• Registration record: registrar NICENIC International Group Co., Limited, created 2026-08-07, expiring 2027-08-07, with owner details incomplete.
• Transport security: TLS certificate issued by WE1 (DV), valid to 2027-01-03.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Broker reputation dataset: no match, so there is no third-party regulatory or reputational record for this domain.

What to Verify Next

Any connection to the real Aave protocol should be established only through its official channels, reached independently of this domain, for example via a bookmarked address or the project's verified social and documentation accounts. If the site claims a company name, licence or audit, each claim should be checked directly against the relevant registry or the auditor's own publication. Any link or message that led to this domain should be traced back to its sender and treated as unsolicited until that sender is authenticated. A wallet that has already interacted with the site should be reviewed for token approvals, and any unrecognised approvals revoked. Evidence:

• Domain name: the lending-brand term plus "fi" suffix on a .info domain should be compared against the official protocol's published address.
• Homepage: the site's behaviour includes heavy post-interaction page changes, so any displayed claims cannot be treated as stable.
• Registration record: the domain is only months old, which leaves no operating history to rely on.

Summary Verdict

The overall posture is high-risk and clearly cautionary. Third-party threat intelligence is decisive, and the site's newness and unverified identity give no basis to discount it. Legitimacy cannot be inferred, and the site is unsuitable for any sensitive or financial interaction.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and WAF. All four observed addresses are Cloudflare edge servers, so the origin host cannot be seen and independent verification of the real hosting is not possible. The domain's bot-protection layer is also Cloudflare. A valid certificate from a known issuer and a normal edge network confirm only that the site is competently delivered, and they do not offset the reputation findings. The 24 abuse reports on one of its edge addresses are attributed to the shared provider address, not to this domain, and are discounted. The same edge address also serves unrelated customers.

Closing Assessment

The site should be treated as read-only at most. Wallets should not be connected, credentials should not be entered, and no funds, approvals or signatures should be given on this domain. Anyone who has already done so should move assets to a fresh wallet and revoke existing approvals.

Signals weighed against the site

• AbuseIPDB: 24 reports on hosting IP 2a06:98c1:3120::b (Cloudflare, Inc., Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.