aave[.]cam

This report details the threat intelligence for the domain aave.cam, assessed on August 07, 2026. The domain is currently active and has been classified as a generic phishing threat with an elevated risk level. Infrastructure analysis reveals that aave.cam resolves to the IP address 104.21.83.24. This IP is associated with a hosting provider commonly used for web services, but the specific ASN and country of origin were not provided in the available intelligence. The domain has a low but notable detection footprint: only 1 out of 91 security vendors on VirusTotal flagged it as malicious. This low detection rate suggests that the domain may be newly deployed or uses evasion techniques to avoid static analysis, and it should not be interpreted as a sign of safety.

Furthermore, aave.cam appears on three separate security blocklists, indicating that multiple independent threat intelligence sources have identified it as suspicious. The domain is specifically blocked by PhishDestroy, MetaMask, and SEAL, which are security tools that actively protect users from phishing and malicious web content. The inclusion on these blocklists, particularly by MetaMask which focuses on crypto-related threats, suggests a potential link to cryptocurrency phishing, although the exact brand or site content has not been analyzed. The exact page content, visual elements, and any login forms have not been inspected, so the precise nature of the phishing lure remains unconfirmed. Defenders should treat aave.cam as a high-priority threat given its active status, elevated risk level, and presence on multiple blocklists.

Organizations should ensure that their DNS filtering and email security gateways block access to this domain. End users should be warned against visiting the site or entering any credentials or personal information.