app[.]v4aave[.]com

This domain, app.v4aave.com, is actively engaged in brand impersonation targeting Aave, a decentralized finance protocol. The threat type is classified as cryptocurrency wallet credential theft through phishing, with the domain currently operational and posing a high risk to users. Analysis indicates the site mimics Aave’s legitimate interface to deceive victims into disclosing private keys or seed phrases. Infrastructure analysis reveals the domain was registered on June 15, 2026, through MAT BAO CORPORATION, a registrar with a history of hosting malicious domains. It resolves to the IP address 104.21.22.101, a Cloudflare-associated endpoint often exploited for anonymity. The domain appears on one security blocklist and is flagged by 4 of 95 security vendors on VirusTotal, including detections for phishing and brand impersonation. The SSL certificate, issued by Google Trust Services (WE1), further enhances its deceptive legitimacy, as users may misinterpret the presence of HTTPS as a trust indicator. Current status confirms the domain remains active, with no takedown or mitigation measures observed as of this report. Users are strongly advised to avoid interaction with app.v4aave.com and any subdomains or associated URLs. Organizations should update web filters to block the domain and its resolving IP. Cryptocurrency wallet holders are urged to verify URLs against Aave’s official communications and enable multi-factor authentication where available. Security teams should monitor for related infrastructure, such as newly registered domains under the same registrar or IP range, to preempt further phishing campaigns.