aave-lend-protocol-dex-relay-v109[.]vercel[.]app

This domain, aave-lend-protocol-dex-relay-v109.vercel.app, is under investigation for DeFi-related phishing activity as of August 03, 2026. The domain is hosted on Vercel's infrastructure, a common platform for both legitimate and malicious deployments. It has been flagged by one security blocklist and is currently blocked by PhishDestroy, though no additional public threat intelligence sources or vendor detections on VirusTotal have been recorded at this time. The absence of detections from 91 scanned vendors on VirusTotal does not confirm safety, as phishing domains often evade initial scans through obfuscation or delayed malicious behavior.

Infrastructure analysis reveals the domain is served via Vercel's content delivery network, which provides SSL encryption by default. No registrar or hosting anomalies are currently documented, though further analysis of DNS records, SSL certificate transparency logs, and subdomain patterns may reveal additional indicators. The domain name itself suggests an attempt to mimic Aave, a decentralized finance protocol, by incorporating terms like 'lend', 'protocol', and 'dex', which are commonly associated with legitimate DeFi platforms. However, the exact content and functionality of the site remain unanalyzed, and no confirmed brand impersonation or specific phishing kit has been identified.

Defenders are advised to treat this domain as suspicious based on its naming convention and blocklist presence. Network-level blocking or monitoring for connections to this domain is recommended, particularly in environments where DeFi or cryptocurrency-related activity occurs. If additional context emerges—such as user reports, phishing kit fingerprints, or malicious payloads—further action may be warranted. Organizations should also review logs for any interactions with this domain and correlate with other indicators of compromise.