vivefondavence-fr[.]live

PhishDestroy identifies the domain vivefondavence-fr.live as an active brand impersonation threat targeting Aave users. This malicious site leverages the trusted Aave brand to deceive visitors into disclosing credentials or cryptocurrency, posing a significant risk to unsuspecting users. The threat level is currently classified as under_investigation, indicating potential escalation pending further analysis.

This domain exhibits multiple red flags: it resolves to IP address 104.21.14.37 and is secured with a Let's Encrypt SSL certificate, which may lend false legitimacy. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain was created on May 03, 2026. VirusTotal analysis shows 0 detections out of 95 engines, with no current presence on major blocklists or threat intelligence feeds. The absence of detections suggests this campaign is either newly deployed or employing evasion techniques.

Organizations should immediately block traffic to vivefondavence-fr.live and its associated infrastructure at the network perimeter. Users must verify all links before clicking, especially those referencing Aave or similar financial platforms. Implement DNS filtering to prevent resolution of this domain. Report the domain to your threat intelligence platform and consider adding it to internal blocklists. Conduct user awareness training to highlight the risks of brand impersonation scams and reinforce safe browsing habits.