app-aavy[.]com

Analysis of app-aavy.com indicates a deliberate brand impersonation campaign targeting the Aave protocol. The domain was registered on February 21, 2026 through OwnRegistrar, Inc. and resolves to the Cloudflare address 172.67.156.134, which is associated with ASN 13335 owned by Cloudflare, Inc., located in the United States. The site presents the page title "Aave - Open Source Liquidity Protocol," matching the targeted brand, and the SSL certificate is identified as "WE1," a low‑trust certificate that received a Gridinsoft score of 0 out of 100.

VirusTotal reports that one of ninety‑three scanning engines flagged the domain, and the domain appears on a single security blocklist. PhishDestroy has already taken the domain offline, and the current status is listed as offline. The primary scam type is described as wallet/seed phishing, suggesting attempts to harvest private keys or recovery phrases from unsuspecting users.

While the available intelligence confirms the infrastructure, the actual content served by the site was not captured during the takedown, leaving the specific phishing page design and request parameters uncertain. Defenders should immediately block the IP address 172.67.156.134 and the hostname app-aavy.com at perimeter and DNS layers, add the domain to web‑gateway and endpoint reputation lists, and monitor for any future registrations that reuse the same registrar or similar naming patterns. Continuous threat‑intel feeds should be consulted for any resurgence of the domain or associated indicators, and any observed attempts to resolve the domain should be logged for forensic correlation.