aavewallet-dfg[.]pages[.]dev

PhishDestroy identifies the domain aavewallet-dfg.pages.dev as an active phishing campaign engaged in brand impersonation targeting Aave. The threat is currently active and leverages deceptive naming to mislead users seeking legitimate Aave wallet services. This domain was flagged by 1 of 95 VirusTotal vendors, indicating limited but confirmed malicious detection. It is registered through Cloudflare, Inc., resolves to IP 172.66.44.161, and holds an SSL certificate issued by Google Trust Services. The campaign is hosted under Cloudflare Pages and utilizes Pages.dev, a legitimate service, to obscure malicious intent. Users should avoid interacting with this domain or any associated links. Immediate actions include blocking the domain at network and endpoint levels, inspecting outbound traffic for connections to 172.66.44.161, and verifying URLs through official Aave channels. Organizations are advised to update threat intelligence feeds and warn users about this impersonation scheme.