aave[.]com-app-v5-wallet-connect[.]com

The domain aave.com-app-v5-wallet-connect.com was registered on 21 February 2026 and is currently listed as offline. VirusTotal scans show three of ninety‑five security vendors flagging the domain, indicating a modest detection rate that aligns with its classification as a crypto‑related impersonation campaign. The site appears on a single public blocklist and has been explicitly blocked by PhishDestroy, reinforcing its malicious reputation.

Infrastructure analysis reveals the domain resolves to the IPv6 address 2a06:98c1:3121::3, which is owned by AS13335 Cloudflare, Inc., placing the host in the United States. The SSL certificate presented is identified as "WE1," a generic certificate that does not provide brand‑specific validation and is typical of fast‑flung phishing infrastructure. The HTTP response recorded in the page title is "com-app-v5-wallet-connect.com | 522: Connection timed out," confirming that the web service is not presently delivering content.

The domain is explicitly labeled as impersonating the Aave brand and is categorized as a crypto scam, suggesting attempts to lure victims into fraudulent wallet connections or token transfers. Defenders should ensure the domain is added to existing URL filtering and DNS sinkhole rules, monitor the associated IP block for any resurgence of malicious activity, and consider sharing the indicator set with threat‑sharing communities. Continuous re‑evaluation is advised, as Cloudflare‑hosted IP ranges are frequently reused, and the domain could be re‑activated under a different sub‑domain or certificate without notice.