track-aave[.]xyz

Analysis of the domain track-aave.xyz, registered as of August 6, 2026, indicates an active phishing campaign targeting users of the Aave decentralized finance protocol. The domain resolves to IP address 172.67.170.42, which is associated with Cloudflare infrastructure, a common tactic to obscure hosting origins and evade IP-based blocking. Detection data from VirusTotal reveals that 3 of 91 security vendors flag this domain as malicious, suggesting early but growing recognition of its fraudulent nature. Additionally, the domain appears on one security blocklist, further corroborating its classification as a phishing threat.

Infrastructure analysis reveals the domain is hosted behind Cloudflare, which limits direct attribution to a specific hosting provider or autonomous system. No registrar details or registration timestamps beyond the report date are available, restricting further assessment of its age or ownership patterns. The low detection count on VirusTotal may reflect either the campaign's recent activation or limited exposure to security vendors at the time of analysis. PhishDestroy has proactively blocked this domain, aligning with its elevated risk designation.

The domain name itself, incorporating 'aave' and 'track,' implies an intent to deceive users into believing it is an official transaction tracking or account management portal for Aave. However, no direct evidence from page titles, HTTP responses, or known phishing kits confirms the exact content or functionality of the site. Defenders should treat this domain as a confirmed phishing resource and prioritize its inclusion in web filtering rules, endpoint protection signatures, and threat intelligence feeds. Organizations operating in the decentralized finance sector are advised to alert users to this threat and monitor for related domains employing similar naming conventions.