aave-staking-markets-defi-v3-v2-aave-swap[.]org

PhishDestroy identifies the domain aave-staking-markets-defi-v3-v2-aave-swap.org as an active brand impersonation targeting the Aave protocol. The domain mimics legitimate DeFi staking terminology to deceive users into surrendering credentials or crypto assets under the guise of Aave-related services. Investigation shows no custom drainer kit deployed; instead the threat relies on lookalike branding and perceived proximity to Aave v2/v3 markets. The attacker leverages urgency around staking markets to bypass scrutiny, exploiting cognitive bias toward protocol adjacency.

Technical indicators validate the risk: VirusTotal reports 4/95 detections at time of analysis, indicating evasion against current AV signatures; the domain resolves to IP 188.114.96.3 via Cloudflare infrastructure; it was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on October 09, 2025; and holds a Google Trust Services SSL certificate. Google Safe Browsing (GSB) has not yet blacklisted the page, and public blocklists include 0 third-party detections. These factors suggest a newly deployed, low-profile campaign still in early propagation.

The domain remains ACTIVE with status under_investigation; no takedown action has been confirmed. Users should treat this domain as hostile—avoid clicking, interacting, or entering credentials. Report the site to Aave’s official phishing channels and browser vendors using the IP (188.114.96.3) and domain hash (70ee4a). Remaining risk is high due to active status, lack of AV coverage, and credible impersonation of a major DeFi protocol.