aave[.]com-app-wallet-api-v3-connect[.]com

The domain aave.com-app-wallet-api-v3-connect.com is a confirmed phishing site engaged in brand impersonation targeting Aave, a cryptocurrency lending platform. It poses an elevated risk as a cryptocurrency scam designed to deceive users into disclosing wallet credentials or sensitive information, though no drainer kit was identified. The site is currently taken offline, but prior activity suggests it was actively used for fraudulent purposes.

Technical indicators confirm the malicious nature of aave.com-app-wallet-api-v3-connect.com. As of analysis, 2 of 95 VirusTotal security vendors flagged the domain, including alphaMountain.ai and Fortinet. The domain appears on 1 security blocklist (PhishDestroy) and was created on February 21, 2026. It resolved to the IP address 172.67.154.16, hosted on Cloudflare's infrastructure (AS13335) in the US. The SSL certificate was issued by WE1, and the observed page title was 'Access Denied' with an HTTP 429 status. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as a phishing threat.

Users who interacted with aave.com-app-wallet-api-v3-connect.com should immediately revoke any token approvals granted to unknown contracts and transfer funds to a new wallet to mitigate potential losses. Change passwords for any accounts linked to the impersonated brand and enable two-factor authentication (2FA) where available. Monitor financial and cryptocurrency accounts for unauthorized transactions. Report the domain to relevant platforms, including Google Safe Browsing, PhishTank, and the impersonated brand’s official security team to aid in takedown efforts.