aave-wallet-us-en[.]pages[.]dev

The domain aave-wallet-us-en.pages.dev was registered on April 05, 2026 and is currently active. It hosts a page titled "AAVE Wallet | The Ultimate DeFi Wallet for Lending and Borrowing," directly referencing the Aave brand, confirming a brand impersonation threat. The site serves HTTP 200 responses and presents a valid SSL certificate issued by Google Trust Services under the WE1 root, indicating the use of Cloudflare's HTTPS termination. DNS resolution points to IP 188.114.96.3, an address owned by Cloudflare, Inc., located in Canada, and the domain is delegated to Cloudflare nameservers buck.ns.cloudflare.com and mimi.ns.cloudflare.com. Reputation data shows a Gridinsoft trust score of 0/100 and that two of ninety‑four security vendors on VirusTotal have flagged the domain, suggesting malicious activity. The domain is listed on one security blocklist and has been blocked by PhishDestroy, reinforcing the assessment of high risk. Although the exact malicious payload or credential‑stealing mechanisms have not been observed, the combination of brand‑targeted page title, active hosting, low trust scores, and vendor detections indicates a deliberate attempt to lure Aave users. Defenders should block the domain at network perimeters, monitor DNS queries for the associated IP, and add the domain to endpoint and email filtering rules. Ongoing observation of traffic to the IP and periodic re‑scanning with threat intelligence services are recommended to detect any evolution in the campaign.