Is aave-v2.vercel.app safe? TrustSniffer's low-trust assessment: 27/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page decentralized-finance (DeFi) landing site on a free subdomain of a general-purpose application hosting platform. Its page title presents it as "Aave — Open Source Liquidity Protocol", offering users the ability to "earn & borrow crypto". It appears intended to pass as a crypto lending and borrowing front end, branded with the name of a well-known liquidity protocol, rather than as an independent business with its own domain.

Scam/Impersonation Risk

This assessment is clearly cautionary. Several independent threat-intelligence engines currently flag the site as malicious or suspicious, including a tier-one security vendor, and the site is blacklisted by those external sources. The detections converge with the site's profile. It carries the name of an established lending protocol while sitting on a generic, freely registrable platform subdomain that closely resembles the platform's own domain. No evidence ties this subdomain to the protocol it names. The site is therefore treated as a high-risk lookalike surface until its operator is shown to be genuine. This is a contradiction-based finding, not a conclusion about intent. No conflicting legal entities were observed, and the sandbox did not directly observe wallet-drainer behavior, clipboard tampering, hidden forms, cloaking, or outbound data posts. The risk therefore centers on what a DeFi lending front end can request from a visitor (wallet connection, token approvals, transaction signing), where a counterfeit interface can cause irreversible loss. Evidence:

• Homepage: titled as an open-source liquidity protocol for earning and borrowing crypto, under a generic hosted subdomain rather than a protocol-controlled domain.
• External reputation: 3 malicious and 1 suspicious detections, with a tier-one vendor among them, against the site's domain.
• Protocol recognition: the site does not match any listed protocol in the DeFi protocol directory, so no verifiable TVL is associated with it.
• Behavioral sandbox: 3 of 3 runs completed with stable responses and no external network activity or wallet-drainer indicators.

Regulatory Verification Notes

The site discloses no legal entity, licence, registration number, or governance information, and the operator cannot be identified from the site. The subdomain structure means domain registration data belongs to the hosting platform rather than to whoever publishes the content, so ownership opacity applies. The absence of disclosures does not by itself indicate fraud, but it removes any accountable party for a service that implies custody of, or interaction with, user funds. No third-party broker or regulatory-database entry matches this site, so there is no reputational context either way. Identity verification is unresolved, and nothing here supports treating the site as the official protocol. Evidence:

• Homepage: no company name, licence, or registration details published.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• Transport encryption: TLS certificate issued by WR1 (domain-validated only), valid to 2026-11-27. This confirms an encrypted connection but nothing about who operates the site.

What to Verify Next

Before any interaction, the address should be compared against the protocol's official domain, obtained through an independent route such as the project's verified social accounts, its documentation, or a trusted aggregator. Any contract addresses the site asks the visitor to approve should be checked against the protocol's published deployments. If a licence or registration is claimed anywhere, it should be confirmed directly with the relevant registry. The site's detection status should be rechecked only after the operator or platform has publicly addressed the flags. Evidence:

• Homepage: branded as a known protocol but not hosted on any domain demonstrably controlled by that protocol.
• Threat-intelligence listings: active at the time of analysis.
• Operator disclosure: none published on the site.

Summary Verdict

The site presents an elevated-risk posture. Active external malicious detections, a blacklisting, and a brand-lookalike profile with no verifiable operator outweigh the technically orderly delivery and clean sandbox behavior. Available evidence does not support treating the site as the genuine protocol or as a safe venue for financial activity.

Infrastructure Integrity

The site runs on a mainstream hosting platform that fronts it with CDN edge servers. All observed addresses are edge nodes, and no origin server was exposed. This is a minor mitigating factor and does not offset the reputation findings. The large volume of abuse reports against the edge address is attributed to shared platform infrastructure serving many tenants. It has therefore been discounted and is not counted against this site. The edge-only visibility does mean the hosted content could be swapped quickly without any externally visible infrastructure change.

Closing Assessment

Use should be limited to passive viewing at most. No wallet should be connected, no token approval or transaction signed, and no credentials or funds submitted. Anyone seeking the genuine protocol should reach it only through an independently confirmed official address.

Signals weighed against the site

• AbuseIPDB: 91 reports on hosting IP 64.29.17.195 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.