daohavens[.]com

PhishDestroy identifies daohavens.com as an elevated-risk domain involved in brand impersonation specifically targeting the Aave decentralized finance protocol. This domain was designed to deceive users into believing it is affiliated with Aave, likely to steal credentials, private keys, or other sensitive information. The domain has since been taken down, but its infrastructure remains a potential threat.

Technical indicators reveal that daohavens.com was created on September 10, 2025, and registered through NETIM. It resolves to the IP address 2.59.22.191 and uses a Let's Encrypt SSL certificate (R12). VirusTotal flagged the domain with 2 out of 95 security vendors marking it as malicious, and it appears on four security blocklists. The page title displayed during analysis was "This website has been suspended!," indicating that hosting provider action was taken, but residual risks may persist.

Users who encounter daohavens.com should avoid clicking any links or entering any personal information. Those who have already interacted with the domain should immediately change their Aave-related passwords, enable two-factor authentication, and monitor their accounts for unauthorized activity. It is also advisable to report the domain to Aave's security team and local cybercrime authorities. PhishDestroy continues to monitor this threat and update its database accordingly.