prime-waves[.]xyz

PhishDestroy identifies prime-waves.xyz as an active brand impersonation domain targeting the Aave protocol with elevated risk. This malicious domain attempts to deceive users by closely mirroring the legitimate Aave brand, which could lead to credential theft or fund loss. Prime-waves.xyz resolves to IP 163.61.188.7 and was registered on April 21, 2026, through COSMOTOWN, INC. using a Let’s Encrypt SSL certificate. VirusTotal analysis confirms 2 out of 95 security vendors have flagged this domain, indicating limited but present detection. The domain’s recent creation date and association with a hosting provider with no established reputation further elevate its risk profile. Given the domain’s specific impersonation of Aave—one of the most targeted DeFi protocols—and its very recent registration tied to a relatively obscure registrar, the potential for malicious activity remains high despite the modest VirusTotal detection rate. Mitigation against this brand impersonation threat requires immediate domain blocking and user awareness. Organizations should add prime-waves.xyz to network blocklists, update DNS filtering rules, and ensure employees or users are informed about the risks of impersonation scams targeting Aave. Additionally, monitoring for similar misspellings or lookalike domains registered around the same time is recommended. Proactive threat hunting using domain age, SSL issuance records, and brand similarity can help prevent similar campaigns from succeeding.