app-aave[.]it[.]com

Analysis indicates that app-aave.it.com is an active brand impersonation campaign targeting users of the Aave ecosystem. The domain is assessed as a credential theft and potential crypto asset draining vector, with infrastructure designed to mimic legitimate decentralized finance access flows. The page is currently active and presents as a Cloudflare interstitial (“Attention Required! | Cloudflare”), which is often used to mask backend phishing infrastructure and delay automated detection.

Technical intelligence confirms that the domain was created on February 21, 2026 and resolves to IP address 104.21.48.101, hosted under AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued under WE1. The domain is flagged by 3 of 95 VirusTotal security vendors and appears on 1 security blocklist. The domain impersonates the Aave brand and leverages trusted CDN infrastructure to obscure origin and improve delivery reliability. No registrar name beyond the it.com domain registration context is provided in the dataset.

At the time of analysis, the domain remains active and operational, increasing the likelihood of ongoing user exposure. The combination of confirmed brand impersonation, active blocklist presence, and non-zero VirusTotal detections indicates elevated risk. Recommended mitigations include immediate blocking at DNS and web proxy layers, monitoring for credential submissions or wallet connection attempts, and performing threat-hunting across endpoint and network logs for related indicators. Continued monitoring is advised until infrastructure is fully decommissioned or sinkholed.