aave-swap[.]click

Analysis of aave-swap.click indicates the domain was registered on June 8, 2026 through Dynadot, LLC. DNS resolution points to the IPv4 address 130.12.180.128, which is currently associated with three public security blocklists. The domain is actively flagged by multiple anti‑phishing and crypto‑wallet protection services, including PhishDestroy, MetaMask, and SEAL, confirming its use in credential‑stealing campaigns. VirusTotal reports five positive detections out of ninety‑one scanners, reinforcing the malicious classification.

No public information on SSL certificates, HTTP response codes, or page title has been disclosed, and the domain does not appear in publicly available Safe Browsing or Open Threat Exchange feeds at the time of analysis. The evidence collectively supports an elevated risk rating and a status of active. Defenders should add the domain to perimeter blocklists, update DNS sinkhole configurations to return NXDOMAIN for 130.12.180.128, and ensure endpoint protection solutions ingest the blocklist entries from PhishDestroy, MetaMask, and SEAL.

Network monitoring should alert on outbound connections to the IP address, and any authentication attempts to services that could be mimicked by the site should be scrutinized. Continuous re‑evaluation is advised in case additional indicators, such as SSL fingerprints or page content hashes, become available.