app-aeve[.]cam

Analysis of the domain app-aeve.cam indicates a targeted seed-phishing campaign impersonating the Aave decentralized finance protocol. The domain was registered on February 21, 2026, and resolved to the IP address 172.67.188.73, which is geolocated in the United States and hosted on Cloudflare's infrastructure (AS13335). The page title, 'Aave - Open Source Liquidity Protocol,' directly matches the branding of the legitimate Aave platform, confirming the intent to deceive users into disclosing wallet recovery phrases or private keys. Detection data reveals limited but targeted flagging: one of ninety-three security vendors on VirusTotal identified the domain as malicious, while two independent security blocklists have listed it.

The domain has been blocked by PhishDestroy and ScamSniffer, both of which specialize in cryptocurrency-related fraud detection. The SSL certificate is issued by WE1, a provider commonly used by both legitimate services and threat actors leveraging Cloudflare's proxy services. As of July 24, 2026, the domain is offline, though historical resolution and detection records remain relevant for defensive measures. Infrastructure analysis shows no evidence of widespread distribution or large-scale hosting, suggesting this may have been a short-lived, high-precision campaign.

The absence of additional detection data does not indicate safety; rather, it reflects the domain's limited exposure or the use of evasion techniques. Defenders should treat app-aeve.cam as a confirmed phishing asset and implement blocks at the DNS, proxy, and endpoint levels. Security teams are advised to monitor for related domains using similar naming patterns (e.g., 'app-[variant].cam') and to alert users about seed-phishing risks targeting decentralized finance platforms.