aave[.]defi[.]blch[.]ru

This report details the threat posed by the domain aave.defi.blch.ru. Based on the page title and impersonated brand, this site was a fraudulent cryptocurrency platform designed to mimic the legitimate Aave DeFi protocol. The threat posed is credential and asset theft, as the site would trick users into connecting their cryptocurrency wallets or entering private keys, leading to unauthorized fund transfers.

Technical analysis confirms the malicious nature of the site. VirusTotal reported 9 detections out of 95 security vendors, with specific flags from BitDefender, Chong Lua Dao, ESET, Fortinet, and G-Data. The domain was created on 2026-02-21 and is present on 1 blocklist. The domain risk score is 63, indicating a high likelihood of malicious activity.

As of the latest check, the domain aave.defi.blch.ru is DOWN or OFFLINE, which neutralizes the immediate threat. However, the overall risk level remains high due to the domain's history and the potential for the same infrastructure to be reused under a different hostname. Users should remain vigilant against similar impersonation attempts.