dappsprotocol[.]xyz

On July 24, 2026 analysts observed that the domain dappsprotocol.xyz is actively flagged as a high‑risk brand‑impersonation site targeting Aave users. The domain was registered on 11 September 2025 via Unstoppable Domains, Inc. and resolves to the Amazon‑owned IP address 64.29.17.1, which is allocated to ASN 16509 in the United States. No TLS certificate is presented; the site operates without SSL, exposing any credentials submitted over HTTP to interception. The page title returned during the brief offline capture reads “Import Wallet”, aligning with the documented scam type of wallet/seed phishing.

VirusTotal records show that ten of ninety‑five scanning engines have raised detections, and the Gridinsoft trust score is zero out of one hundred, indicating a strong malicious reputation. The domain appears on four independent blocklists, specifically PhishDestroy, Polkadot, Enkrypt, and Codeesura, confirming that multiple security communities have taken mitigation steps. The site’s current status is offline, so live content cannot be verified, but the historical evidence points to an attempt to harvest private keys or seed phrases from unsuspecting Aave users.

Defenders should continue to block the domain at network perimeters, update DNS‑based filtering with the listed blocklists, and monitor for any resurgence of the IP address or associated Amazon‑hosted resources. Incident response teams should also educate end‑users about the “Import Wallet” lure and advise against entering any wallet credentials on unauthenticated domains. Ongoing observation of the registrar’s activity and periodic re‑scans with VirusTotal are recommended to detect any re‑activation.