aavesvap[.]pages[.]dev

The domain aavesvap.pages.dev was created on October 18, 2025 and is currently resolved to the IP address 172.66.47.137, which belongs to AS13335 Cloudflare, Inc. in the United States. The domain is served through Cloudflare’s infrastructure, employing HSTS and HTTP/3, and presents a valid SSL certificate issued by Google Trust Services (WE1). The site returns HTTP status 200 and displays the page title "Aave Login — Secure Access to Your DeFi Dashboard," directly targeting the Aave brand. Independent analysis by VirusTotal records nine detections out of ninety‑three scanners, and Google Safe Browsing classifies the domain under the SOCIAL_ENGINEERING category. The domain appears on at least one public security blocklist and has been flagged by PhishDestroy, while the Gridinsoft trust score is 0 out of 100, indicating a high likelihood of malicious intent. The nameservers listed are abdullah.ns.cloudflare.com and donna.ns.cloudflare.com, both owned by Cloudflare. Evidence points to a brand‑impersonation scam aimed at deceiving Aave users, potentially to harvest credentials or redirect funds. Uncertainty remains regarding the exact payload delivered after login, as page content beyond the title has not been publicly disclosed. Defenders should block the domain at network perimeter, add it to internal phishing blocklists, monitor DNS queries for the domain and its associated IP, and enforce user education regarding unsolicited Aave login requests. Continuous reassessment is advised as additional indicators may emerge.