aave-live[.]vercel[.]app

On 2026-08-03 the domain aave-live.vercel.app was observed to be active in a generic phishing campaign. The domain is listed on a single security blocklist and is explicitly blocked by the PhishDestroy service. No additional infrastructure details such as IP address, autonomous system, hosting provider, or registrar have been published in the current intelligence set. The site has not been indexed by common Safe Browsing or Open Threat Exchange feeds, and no SSL certificate metadata, HTTP response codes, or page‑title information are available.

The classification as generic phishing derives from the blocklist entry and the naming pattern that mimics the legitimate Aave service, although the exact content of the landing page has not been examined. Because the domain is marked as active and its risk level remains under investigation, defenders should treat it as malicious until further analysis proves otherwise. Recommended mitigation steps include adding aave-live.vercel.app to network‑level deny lists, updating endpoint protection signatures to incorporate the PhishDestroy blocklist entry, and configuring DNS filtering to prevent resolution of the domain.

Continuous monitoring for any new detections, changes in blocklist status, or emergence of hosting details is advised. Incident response teams should be prepared to block related URL patterns that reference the aave‑live subdomain and to investigate any authentication attempts that involve the Aave brand. Coordination with threat intelligence sharing communities can help surface additional indicators if the campaign expands.