app-aave-l1[.]com

This domain, app-aave-l1.com, is flagged for brand impersonation targeting Aave, a decentralized finance protocol. Analysis indicates the site mimics legitimate Aave interfaces to deceive users into disclosing credentials or transferring assets. No drainer kit signatures have been identified at this stage, but the domain exhibits characteristics consistent with phishing infrastructure, including a recently registered domain name and a page title matching the URL structure. Infrastructure analysis reveals the following technical indicators: the domain was registered on June 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to IP address 172.67.199.36, a Cloudflare-assigned address often used to obfuscate hosting origins. As of the latest scan, VirusTotal reports 0/95 detections, suggesting the domain has not yet been widely flagged by security vendors. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy. Google Safe Browsing (GSB) has not listed the domain, and no blocklist entries have been recorded at this time. The domain remains active, and no takedown actions have been observed. While the current detection rate is low, the lack of prior scrutiny increases the risk of successful phishing campaigns. Users and organizations are advised to block the domain at the network level and monitor for connections to 172.67.199.36. Security teams should prioritize retroactive log analysis for any interactions with app-aave-l1.com, particularly in environments where Aave or other DeFi platforms are in use. Continuous monitoring for additional detections or malicious payloads is recommended due to the domain's recent registration and active status.