oave[.]app

Analysis of oave.app indicates that the domain was registered on February 21, 2026 and is currently taken offline. The site resolves to the IP address 172.67.153.239, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The TLS certificate presented is identified as WE1, confirming the use of HTTPS. The page title returned from the server is “Aave – Open Source Liquidity Protocol”, matching the brand target aave and confirming the intent to impersonate the legitimate Aave service.

The campaign is classified as wallet/seed phishing, aiming to harvest private keys or seed phrases from unsuspecting users. The domain is listed on one security blocklist and has been blocked by the PhishDestroy service. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence in malicious intent. VirusTotal analysis shows that ten of ninety‑three scanning engines flagged the domain as malicious, reinforcing the assessment.

No additional public intelligence such as OTX indicators or Safe Browsing entries were supplied. Given the convergence of brand impersonation, low trust score, blocklist presence, and multiple vendor detections, defenders should treat oave.app as a confirmed malicious infrastructure. Recommended actions include adding the domain to internal deny lists, monitoring DNS queries for the associated IP address, and ensuring that any credential or seed‑phrase collection mechanisms are blocked at the network perimeter. Continuous observation of the hosting provider’s abuse channels is advised in case the site reappears under a different sub‑domain or IP.