savecapital[.]cyou

This domain, savecapital.cyou, is flagged as a high-risk brand impersonation threat targeting Aave, a decentralized finance protocol. Analysis indicates the site is designed to mimic Aave’s legitimate interface, likely deploying a cryptocurrency drainer kit to harvest wallet credentials and private keys from unsuspecting users. The domain’s infrastructure and content align with known phishing campaigns aimed at DeFi platforms, where attackers exploit trust in the brand to execute unauthorized transactions. Infrastructure analysis reveals the domain was registered on May 24, 2026, through Global Domain Group LLC. It is currently active and has been detected by 3 out of 95 security vendors on VirusTotal, indicating limited but confirmed malicious classification. The domain appears on three security blocklists, including PhishDestroy and SEAL, and is explicitly blocked by MetaMask’s built-in protection mechanisms. No associated IP address or Google Safe Browsing (GSB) status is currently recorded, but the domain’s creation date suggests a recent and deliberate setup for malicious purposes. As of the latest assessment, savecapital.cyou remains active, posing an ongoing risk to users who may interact with it under the false pretense of accessing Aave services. Response actions include its inclusion on multiple blocklists and warnings from security providers, but the domain has not been taken down by the registrar. Users are advised to verify domain authenticity through official Aave channels, avoid interacting with the site, and report any encounters to their security teams. The remaining risk is classified as high due to the domain’s active status and direct targeting of cryptocurrency assets.