app-avae[.]cam

The domain app-avae.cam was registered on February 21, 2026 and is presently taken offline. Infrastructure analysis shows the domain resolves to IP address 104.21.96.1, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The SSL certificate presented is identified only as WE1, providing no indication of a trusted chain. Reputation services give it extremely low scores: Scamadviser rates the domain 1 out of 100, and Gridinsoft assigns a zero‑score, reflecting a high likelihood of malicious intent. The site has been placed on multiple blocklists, specifically flagged by PhishDestroy and ScamSniffer, and appears on two additional security blocklists.

VirusTotal reports that 2 out of 93 scanning engines have flagged the domain, reinforcing the suspicion. The page title returned from the server reads "Aave - Open Source Liquidity Protocol," which directly references the Aave brand, matching the listed brand target. The listed scam type is wallet/seed phishing, indicating an aim to harvest private keys or recovery phrases from users. What remains uncertain is the exact content that was served before the domain was taken offline; no visual or functional details are available beyond the page title.

Defenders should treat app-avae.cam as a confirmed brand‑impersonation phishing asset. Immediate actions include maintaining the domain on existing blocklists, monitoring the IP address for any re‑use, and ensuring that any internal security controls that rely on URL reputation or SSL validation flag this domain as malicious. Organizations using web filtering or endpoint detection should update signatures to block traffic to app-avae.cam and related Cloudflare IP ranges that have been associated with phishing activity. Continuous reconnaissance is advised to detect potential re‑hosting under different domains or new infrastructure tied to the same threat actor.