treasury-defisaver[.]com

The domain treasury-defisaver.com is a cryptocurrency phishing site engaged in brand impersonation targeting Aave users. It presents itself as an official platform to deceive victims into connecting wallets or entering sensitive credentials, posing a direct risk of unauthorized fund access or theft. As of the latest verification, treasury-defisaver.com has been taken offline, though it previously operated without a detected drainer kit.

Technical analysis shows treasury-defisaver.com had 0 of 95 VirusTotal vendors flagging it as malicious, and Google Safe Browsing did not list it as unsafe. The domain appeared on 1 security blocklist (PhishDestroy) and was registered on 2026-02-21. It resolved to the IP address 104.21.89.101, hosted by Cloudflare in the US, and used an SSL certificate issued by WE1. The observed page title was 'Official Page', reinforcing its attempt to mimic legitimate Aave services.

Users who interacted with treasury-defisaver.com should immediately revoke any token approvals granted to unknown contracts and transfer funds to a new wallet. Enable two-factor authentication on all accounts and monitor for unauthorized transactions. Report the domain to platforms like PhishTank or the Anti-Phishing Working Group to assist in broader mitigation efforts.