app[.]aave[.]avwork[.]top

This report details the threat posed by the domain app.aave.avwork.top. The site is a cryptocurrency scam that impersonates the legitimate Aave brand, displaying the page title "Aave - Open Source Liquidity Protocol." The threat is that it attempts to deceive users into believing they are interacting with the authentic Aave DeFi protocol, likely to steal cryptocurrency credentials or funds.

Technical evidence confirms the malicious nature of this domain. VirusTotal shows 3 detections out of 95 security vendors, with flags from CRDF, Gridinsoft, and Trustwave. The domain is also present on 2 blocklists. It was created on 2026-02-21 and registered through Web Commerce Communications Limited. The IP address 104.21.48.1 is located in the US and belongs to AS13335 Cloudflare, Inc. The SSL certificate is issued by Let's Encrypt (E7), and nameservers are kallie.ns.cloudflare.com and kyle.ns.cloudflare.com.

The site is currently down or offline. With a domain risk score of 56 out of 100, this is a moderate-to-high risk threat. Despite being offline, the domain remains registered and could be reactivated, posing an ongoing risk of credential theft or financial loss to users targeting the impersonated Aave brand.