fbsaver[.]pages[.]dev

This domain, fbsaver.pages.dev, is currently under investigation for brand impersonation targeting the decentralized finance protocol Aave. Analysis indicates the site is actively mimicking legitimate Aave services, potentially to deceive users into disclosing sensitive information or interacting with malicious smart contracts. The domain remains operational as of the latest assessment, posing a risk to unsuspecting visitors seeking Aave-related services. Infrastructure analysis reveals the domain was registered on March 28, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, associated with Cloudflare’s content delivery network in Canada. Despite its recent creation, the domain has already been flagged by one security blocklist, though it remains undetected by all 95 VirusTotal vendors as of the latest scan. The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious domains. The page title, 'Fbsaver - Free Facebook Video Downloader App,' appears unrelated to Aave, suggesting an attempt to obfuscate the true intent of the domain. Current risk assessment categorizes this domain as active and under investigation, with moderate confidence in its malicious intent due to the brand impersonation and infrastructure anomalies. Users are strongly advised to avoid interacting with fbsaver.pages.dev and any associated links. Organizations should consider adding the domain and its resolving IP (188.114.97.3) to network blocklists to prevent access. Additionally, monitoring for further detections on VirusTotal or other threat intelligence platforms is recommended, as the domain’s low detection rate may change with additional scrutiny. Verification of any Aave-related communications or services should be conducted exclusively through official channels to mitigate exposure to this threat.