wallet-save[.]ru

This domain, wallet-save.ru, is flagged for brand impersonation targeting Aave, a decentralized finance protocol. The site presents a fraudulent 'Wallet check' interface designed to harvest credentials or private keys from users under the guise of legitimate wallet verification. Analysis indicates the domain is structured to exploit trust in Aave’s branding, potentially leading to unauthorized access to cryptocurrency wallets or financial loss for victims. Infrastructure analysis reveals the domain was registered on April 19, 2026, through REGTIME-RU, a registrar with a history of hosting malicious domains. It resolves to the IP address 172.67.220.26, which is part of Cloudflare’s network, a common tactic to obscure hosting origins. The domain appears on one security blocklist and is flagged by 4 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. Technologies detected include Cloudflare Browser Insights and HTTP/3, further indicating an attempt to mimic legitimate web infrastructure. Users who visited wallet-save.ru should immediately revoke any wallet permissions granted to the site and transfer assets to a new wallet if credentials were entered. Monitor transaction histories for unauthorized activity and report the incident to relevant security teams or blockchain analytics platforms. Given the elevated risk level and offline status, users are advised to remain vigilant for similar phishing attempts targeting Aave or other DeFi protocols. No further interaction with the domain should occur, and any cached data should be cleared from browsers.