wallet-us-aavee[.]pages[.]dev

PhishDestroy identifies wallet-us-aavee.pages.dev as an active brand-impersonation domain targeting Aave users. This domain mimics the legitimate Aave platform to steal cryptocurrency credentials and funds. The threat actor leverages a drainer kit designed to siphon assets from unsuspecting victims who land on the fake interface. The domain’s infrastructure is hosted through Cloudflare, providing anonymity and resilience against takedown efforts.

This domain was flagged by 2 out of 95 VirusTotal security vendors and is associated with the IP address 188.114.97.3. The SSL certificate is issued by Google Trust Services, adding a false sense of legitimacy to the phishing page. Registered through Cloudflare, Inc., the domain’s registration details are obscured, making attribution difficult. While the exact creation date is not disclosed in the available data, the domain is currently active and operational. The low detection rate on VirusTotal suggests that this threat may evade some automated defenses, increasing the risk of successful exploitation.

As of the latest analysis, this domain remains active and poses an elevated risk to users who may be tricked into entering their Aave credentials. Immediate action includes blocking the domain and IP address at the network perimeter. Security teams should also monitor for any outbound connections to 188.114.97.3 and alert users to avoid interacting with wallet-us-aavee.pages.dev. The remaining risk is moderate due to the domain’s use of legitimate hosting services and SSL certificates, which can deceive users into believing the site is trustworthy. Continuous monitoring and proactive threat hunting are recommended to mitigate further exposure.