v5j74zhm3mf747qgvh5xkg67ks6fxaoclplauxtnqrpqeymsse3q[.]arweave[.]net

This domain is an active high-risk crypto drainer impersonating the decentralized finance platform Aave. Users who connect wallets to the site are exposed to smart contract exploits that automatically transfer funds to attacker-controlled addresses. The page displays a generic 'Loading…' title, a common tactic to delay user recognition of malicious activity while backend scripts prepare the drainer payload. Analysis indicates the site is designed to mimic Aave’s legitimate interface, tricking users into approving transactions that grant unlimited token access to the attacker. Infrastructure analysis reveals the domain is hosted on the Arweave network, a decentralized storage platform often abused for phishing due to its resistance to takedowns. The domain is flagged by 3 out of 95 security vendors on VirusTotal, including detections for brand impersonation and malicious web content. Additionally, it appears on three security blocklists, further confirming its malicious status. Registration details link the infrastructure to NameCheap, Inc., a registrar frequently associated with phishing campaigns targeting cryptocurrency users. If a user has interacted with this domain, immediate action is required to mitigate financial loss. First, revoke any token approvals granted to the site via a blockchain explorer or wallet interface. Next, transfer remaining assets to a new, secure wallet address. Monitor connected wallets for unauthorized transactions and report the incident to relevant security teams or community alert platforms. Users should also verify the legitimacy of any decentralized finance platform by cross-referencing official documentation and community channels before connecting wallets.