app-aave-v1[.]com

The domain app-aave-v1.com has been identified as a brand impersonation threat specifically targeting Aave, a well-known decentralized finance protocol. Analysis indicates this domain was designed to mimic legitimate Aave services, likely to facilitate fraudulent activities such as crypto asset theft or credential harvesting. As of the latest assessment, the domain has been taken offline, though prior activity suggests it was actively used in malicious campaigns. Infrastructure analysis reveals several critical indicators. The domain was flagged by 5 of 95 security vendors on VirusTotal, indicating detection by multiple threat intelligence sources. It resolves to the IP address 104.21.95.231, a Cloudflare-associated address that may have been leveraged to obscure its true origin. Registered on June 10, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain appears on at least one security blocklist. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as legitimate-looking encryption is commonly exploited in phishing schemes. The creation date, well in the future from current standards, suggests either a typographical error in records or an attempt to manipulate domain age perception. Given the elevated risk level and confirmed brand impersonation, users and organizations are advised to treat this domain as malicious. Although currently offline, similar domains may resurface under different names or TLDs. Security teams should monitor for related indicators, including the IP address 104.21.95.231 and the registrar NICENIC INTERNATIONAL GROUP CO., LIMITED, in network logs or threat feeds. Users who interacted with this domain should revoke any connected wallet permissions, rotate credentials, and scan systems for malware. Proactive measures, such as blocking the domain and IP at the firewall level, are recommended to prevent potential re-emergence or lateral movement within networks.