aave-staking-markets-defi-v3-v2-aave-swap[.]net

PhishDestroy identifies active brand impersonation campaign leveraging the domain aave-staking-markets-defi-v3-v2-aave-swap.net to impersonate the Aave DeFi protocol. This domain is part of a fraudulent staking interface designed to deceive users into connecting wallets and approving malicious token transfers. Security telemetry indicates this infrastructure is likely part of a broader drainer-as-a-service operation, though no custom drainer kit has been extracted from available metadata at this time. The threat type is classified as brand impersonation, with clear intent to exploit trust in Aave’s established ecosystem. Initial access points appear to target users searching for liquidity staking solutions on Ethereum layer-2 networks, particularly those associated with Aave v3 deployments. This domain resolves to IP address 172.67.213.190 via Cloudflare proxy, a common tactic to mask origin infrastructure. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on October 9, 2025, suggesting recent acquisition for malicious use. At the time of analysis, VirusTotal reported zero detections out of 95 engines, indicating limited signature-based detection. The domain holds a valid SSL certificate issued by Google Trust Services (formerly GlobalSign), increasing visual authenticity. As of now, this domain remains unlisted on Google Safe Browsing (GSB) and has accumulated no known blocklist entries, allowing continued operation with low public visibility. Registration patterns and naming conventions align with semi-automated bulk registration typically used in credential harvesting and cryptocurrency scam campaigns. Current status of this campaign is active, with the domain operational and propagating via social media and search engine optimization (SEO) manipulation targeting queries related to Aave v3 staking and DeFi protocols. Response actions include ongoing monitoring by PhishDestroy for URL takedown and DNS sinkholing, coordination with Cloudflare and domain registrars for abuse reporting, and proactive notification to Aave security teams. While the technical risk remains elevated due to undetected status and operational infrastructure, user risk is elevated given the domain’s plausible branding and staking-related naming. Immediate mitigation includes blocking the domain and IP at network, endpoint, and DNS levels; users should verify all staking websites via official Aave channels and avoid clicking unsolicited links. Remaining risk includes potential domain persistence through fast flux or rapid registrar changes, as well as collateral damage to users who rely on misspelled or auto-corrected versions of legitimate domain names. Continuous threat hunting and proactive threat intelligence dissemination remain critical to prevent fund loss and maintain ecosystem integrity.