mollavest[.]icu

PhishDestroy identifies an active phishing campaign targeting the Aave brand via the domain mollavest.icu. The site is currently under investigation as a brand impersonation threat, with confirmed malicious intent to deceive users familiar with the Aave protocol.

This domain was flagged by 3 of 95 VirusTotal vendors as of the latest scan, indicating a currently low detection rate despite its active status. The domain resolves to IP 43.169.14.15, which is registered through Dominet (HK) Limited. mollavest.icu was created on March 26, 2026, and operates with an SSL certificate issued by TrustAsia Technologies, Inc. These technical details suggest a recently established infrastructure leveraging low-detection tactics to evade immediate scrutiny.

The domain remains active and poses a significant risk to users interacting with Aave-related services. PhishDestroy recommends immediate blocking of mollavest.icu at the network and endpoint levels, along with heightened scrutiny for any communications referencing Aave from unknown domains. Users should verify URLs and SSL certificates before entering credentials or financial information. Additionally, reporting this domain to threat intelligence platforms and updating blocklists will aid in disrupting this campaign. Continuous monitoring is advised until the threat is fully mitigated.