aave[.]com-app-connect-v2-wallet[.]com

On 24 July 2026 the domain aave.com-app-connect-v2-wallet.com was observed to be offline but its historical infrastructure indicates a confirmed crypto‑scam campaign targeting users of the Aave platform. The domain was registered on 21 February 2026 and resolves to the IP address 104.21.75.195, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The TLS certificate presented for the host is identified as “WE1”, a generic Cloudflare‑issued certificate that does not provide any brand‑specific validation. An HTTP request to the site returned a 522 status code (“Connection timed out”), and the page title captured by scanners reads “com-app-connect-v2-wallet.com | 522: Connection timed out”.

VirusTotal scans show that five out of ninety‑three security vendors flagged the domain as malicious, reinforcing the suspicion of abuse. The domain appears on a single public blocklist and is actively blocked by the PhishDestroy service. The risk rating assigned by the reporting system is “elevated”, reflecting the combination of brand impersonation (Aave), the use of a reputable CDN to hide origin, and the presence of multiple vendor detections.

No further content was captured before the takedown, so the exact phishing page layout and credential‑harvesting mechanisms remain unknown. Defenders should continue to deny any network traffic to the resolved IP address, add the fully qualified domain name to local and upstream DNS blocklists, and monitor for newly registered domains that reuse the “aave.com‑app‑connect‑v2‑wallet.com” pattern. Continued observation of Cloudflare‑originated IP ranges for similar short‑lived domains is recommended, as the infrastructure may be repurposed for future campaigns.