aavelegacy[.]com

aavelegacy.com is a confirmed phishing domain that impersonates the Aave cryptocurrency brand to conduct brand impersonation scams. The domain is now taken offline, but while active it posed a threat to users seeking legitimate Aave services by mimicking the brand's appearance to steal login credentials or cryptocurrency assets. No drainer kit was identified, but the domain's design and purpose align with credential-harvesting or wallet-connection fraud targeting Aave users.

Technical indicators for aavelegacy.com include detection by 2 of 95 VirusTotal vendors (Fortinet and SOCRadar), registration through Name SRS AB on November 24, 2025, and resolution to IP address 172.67.135.244 hosted by Cloudflare (AS13335) in the United States. The domain appears on 1 security blocklist (PhishDestroy) and has a Gridinsoft trust score of 0/100. Google Safe Browsing did not flag the domain, and no SSL certificate was issued. The page title observed was 'Just a moment...', and nameservers are decker.ns.cloudflare.com and hera.ns.cloudflare.com.

Users who interacted with aavelegacy.com should take immediate safety steps. Since this is a cryptocurrency brand impersonation, if any wallet connection or approval was granted, revoke all token approvals for the site and move funds to a new, secure wallet. Change passwords for any accounts used on the domain and enable two-factor authentication where available. Monitor for unauthorized transactions or phishing follow-ups. Report the domain to PhishDestroy and other security blocklists to help protect other users.