concave-device-266580[.]framer[.]app

concave-device-266580.framer.app is a live fraudulent domain detected by PhishDestroy, actively impersonating the Aave brand to deceive users into disclosing cryptocurrency credentials or funds. The site is hosted on Framer.app, a legitimate website builder, which has been abused to deploy a site spoofing Aave’s official interface. No drainer kit fingerprint was observed during initial analysis, but the domain’s page structure closely mirrors Aave’s UI, including cloned forms and transaction simulation pages, indicating a high-fidelity impersonation campaign designed to harvest private keys or initiate malicious wallet connections.

Technical indicators confirm elevated risk: VirusTotal reports a detection score of 11 out of 95 security vendors, indicating partial but not universal detection. The domain resolves to IP address 31.43.161.6 via a Let’s Encrypt SSL certificate, suggesting opportunistic encryption to appear trustworthy. While the top-level domain (framer.app) is a subdomain under Framer’s platform, the full subdomain concave-device-266580 is likely auto-generated or dynamically assigned, complicating takedown via registrar-level blocks. Google Safe Browsing (GSB) status is unconfirmed in this dataset, and no public blocklist count is provided, though 11 detections suggest partial inclusion in security feeds. The domain is newly active and lacks historical reputation, amplifying its threat potential.

The domain remains active and is currently serving fraudulent content targeting Aave users. Immediate response actions include IP and domain blocking at network and endpoint levels, and reporting to Framer.app abuse channels for subdomain takedown. Aave stakeholders should issue public advisories with the domain listed, and organizations using Aave should implement DNS and browser-based blocklists. Although the risk is elevated due to active impersonation and partial detection, the absence of a known drainer kit and limited spread suggest the campaign is in early deployment. Continuous monitoring and proactive threat hunting are required to prevent user exposure and financial loss.