app[.]aawve[.]com

Analysis of the domain app.aawve.com indicates a wallet and seed-phishing campaign targeting users of the Aave decentralized finance protocol. The domain was registered on February 21, 2026, and resolved to the IP address 217.114.42.73, hosted under AS57724 (DDOS-GUARD LTD) in Russia. The page title, 'Aave - Open Source Liquidity Protocol,' directly mirrors the branding of the legitimate Aave platform, confirming intent to deceive users into disclosing sensitive credentials. Infrastructure review reveals the domain was flagged by 12 of 93 security vendors on VirusTotal, suggesting moderate detection coverage at the time of assessment.

It also appeared on two independent security blocklists, including PhishDestroy and ScamSniffer, further validating its malicious classification. The SSL certificate, issued under the R10 root, does not provide meaningful trust signals, and the Gridinsoft trust score of 0/100 reinforces the domain's high-risk status. As of July 23, 2026, the domain is offline, though historical resolution and detection data remain relevant for retrospective threat hunting. Defenders should treat any prior resolution to 217.114.42.73 or association with the seed identifier 'dceb21' as indicators of compromise.

Organizations are advised to block the domain, IP, and associated SSL certificate across security gateways and endpoint protection systems. Given the targeting of cryptocurrency wallets, users who may have interacted with the domain should be directed to revoke active sessions and monitor for unauthorized transactions. The exact phishing kit or payload delivery mechanism remains unconfirmed, as no forensic artifacts from the live page are currently available for analysis.