# PhishDestroy domain threat record: aave-pro.sbs Content language: English Canonical HTML report: https://phishdestroy.io/domain/aave-pro.sbs/ Machine-readable companion: https://phishdestroy.io/domain/aave-pro.sbs/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-25 02:00:08 UTC - Last availability or vendor check: 2026-10-25 02:00:08 UTC - Stored record updated: 2026-10-25 03:47:39 UTC - VirusTotal detections in the stored snapshot: 1/92 - Independent public blocklist matches in the stored snapshot: 1 - Matching public blocklists: ScamSniffer - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Aave ## Stored infrastructure - Observed IP address: 188.114.96.3 - Registrar in stored WHOIS data: NameSilo, LLC - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-10-16 07:54:27 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a170c8-44dd-72ec-8adf-39a8e74fb3cd/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/aave-pro.sbs - Certificate Transparency search: https://crt.sh/?q=%25.aave-pro.sbs - Web Archive lookup: https://web.archive.org/web/*/https://aave-pro.sbs/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s automated assessment classifies aave-pro.sbs as a crypto wallet drainer. The domain was first observed by PhishDestroy on 2026-10-25 serving a page titled “Aave Pro” with an HTTP 200 status; the initial intake noted insufficient page content for deeper analysis. How the scam works A crypto wallet drainer typically lures victims into connecting a blockchain wallet and approving a malicious contract that can transfer assets without further user interaction. The scheme relies on social engineering around trusted brand names to gain the victim’s trust before prompting the wallet connection. Evidence VirusTotal recorded one suspicious detection out of 92 engines, flagged by alphaMountain.ai on 2026-10-24. URLScan’s automated analysis on 2026-10-25 marked the site malicious with a 100 score, categorising it as phishing and linking it to the Aave brand. Google Safe Browsing reported no flag on 2026-10-25, while external blocklist ScamSniffer listed the domain, and OTX showed four related pulses on 2026-10-25. PhishDestroy’s internal blocklist also contains the domain. Infrastructure The domain was registered with NameSilo on 2026-10-16, nine days before first sighting, and uses Cloudflare nameservers without DNSSEC. A TLS certificate issued by Let’s Encrypt for *.aave-pro.sbs was valid from 2026-10-16 to 2027-01-14, and the recorded IP address was 172.67.158.30. What to do Users should avoid entering wallet credentials or approving transactions on this site; if a connection was made, revoke any contract approvals and consider moving funds to a new wallet. Organizations should block the domain at the network perimeter, monitor logs for outbound connections, and add the domain to threat‑intel feeds for incident response. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a170c8-44dd-72ec-8adf-39a8e74fb3cd/ Cloudflare Radar report: https://radar.cloudflare.com/scan/0602a287-4d0f-48b3-8ece-e6ec7bed3aea Stored capture screenshot: https://i.ibb.co/Kz3pHXCY/0aafa3193184.png Cloudflare Radar screenshot (2026-10-25T02:34:39Z): https://screenshots.phishdestroy.io/cf/0602a287-4d0f-48b3-8ece-e6ec7bed3aea.png URLScan screenshot (2026-10-23T13:08:51Z): https://screenshots.phishdestroy.io/us/01a168e0-c3b5-728e-b989-d063c869e594.png URLScan capture report: https://urlscan.io/result/01a168e0-c3b5-728e-b989-d063c869e594/ URLScan screenshot (2026-10-23T20:51:06Z): https://screenshots.phishdestroy.io/us/01a16a87-ff30-76f8-a4db-d3d5302616ad.png URLScan capture report: https://urlscan.io/result/01a16a87-ff30-76f8-a4db-d3d5302616ad/ URLScan screenshot (2026-10-24T00:44:40Z): https://screenshots.phishdestroy.io/us/01a16b5d-b9aa-7377-9fe6-ffbe2a0dbb6d.png URLScan capture report: https://urlscan.io/result/01a16b5d-b9aa-7377-9fe6-ffbe2a0dbb6d/ URLScan screenshot (2026-10-24T04:49:05Z): https://screenshots.phishdestroy.io/us/01a16c3d-993c-724f-b06a-3df01005a506.png URLScan capture report: https://urlscan.io/result/01a16c3d-993c-724f-b06a-3df01005a506/ URLScan screenshot (2026-10-24T12:48:07Z): https://screenshots.phishdestroy.io/us/01a16df4-2661-77ab-bb54-7545c50fec66.png URLScan capture report: https://urlscan.io/result/01a16df4-2661-77ab-bb54-7545c50fec66/ VirusTotal report: https://www.virustotal.com/gui/domain/aave-pro.sbs Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=aave-pro.sbs Archived copy: https://web.archive.org/web/20261025015847/https://aave-pro.sbs/ Revoke token approvals: https://revoke.cash/ Report crypto fraud (Chainabuse): https://www.chainabuse.com/report Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-25 03:46:05 UTC ## Stored page captures - Primary capture: https://i.ibb.co/Kz3pHXCY/0aafa3193184.png Captured: 2026-10-25 02:00:08 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a170c8-44dd-72ec-8adf-39a8e74fb3cd.png Captured: 2026-10-25 02:00:08 UTC Source report: https://urlscan.io/result/01a170c8-44dd-72ec-8adf-39a8e74fb3cd/ - URLScan capture 2: https://urlscan.io/screenshots/01a16df4-2661-77ab-bb54-7545c50fec66.png Captured: 2026-10-25 01:57:39 UTC Source report: https://urlscan.io/result/01a170c8-44dd-72ec-8adf-39a8e74fb3cd/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/0602a287-4d0f-48b3-8ece-e6ec7bed3aea.png Captured: 2026-10-25 02:34:39 UTC Source report: https://radar.cloudflare.com/scan/0602a287-4d0f-48b3-8ece-e6ec7bed3aea SHA-256: 5a4f293a5138dcfee9d3f5655077379fb49ffb4a242756e9908ff0779c02db0b - URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a168e0-c3b5-728e-b989-d063c869e594.png Captured: 2026-10-23 13:08:51 UTC Source report: https://urlscan.io/result/01a168e0-c3b5-728e-b989-d063c869e594/ SHA-256: 53b7d61790066c587fa5fc879b28bf49dde13f06815ec1d73e73cc03d977b5d2 - URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16a87-ff30-76f8-a4db-d3d5302616ad.png Captured: 2026-10-23 20:51:06 UTC Source report: https://urlscan.io/result/01a16a87-ff30-76f8-a4db-d3d5302616ad/ SHA-256: e9857718de77acff9d46e9a004751f23976c82fad38d12f12d7420596fa005f6 - URLScan · 2026-10-24: https://screenshots.phishdestroy.io/us/01a16b5d-b9aa-7377-9fe6-ffbe2a0dbb6d.png Captured: 2026-10-24 00:44:40 UTC Source report: https://urlscan.io/result/01a16b5d-b9aa-7377-9fe6-ffbe2a0dbb6d/ SHA-256: 626d0bfd423d7b4ca975e49463b383109dc212a5f9009d97dd554ac0bb18857e - URLScan · 2026-10-24: https://screenshots.phishdestroy.io/us/01a16c3d-993c-724f-b06a-3df01005a506.png Captured: 2026-10-24 04:49:05 UTC Source report: https://urlscan.io/result/01a16c3d-993c-724f-b06a-3df01005a506/ SHA-256: 0dd1af9a8b0a7233653c4b61548245b67fb8a7a2aea8111f2cbd12f2d7687e8d - URLScan · 2026-10-24: https://screenshots.phishdestroy.io/us/01a16df4-2661-77ab-bb54-7545c50fec66.png Captured: 2026-10-24 12:48:07 UTC Source report: https://urlscan.io/result/01a16df4-2661-77ab-bb54-7545c50fec66/ SHA-256: c7d6aa2f5a0d06768bcf5d92f48939fb16733414f979e49b0cc4910e3a55ebe7 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-25T02:13:33Z", "uuid": "01a170c8-44dd-72ec-8adf-39a8e74fb3cd", "scanned_at": "2026-10-25T01:59:06Z", "final_url": "https://aave-pro.sbs/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://aave-pro.sbs/", "from": "http://aave-pro.sbs/", "status": 307 } ], "ip": "172.67.158.30", "domains": [ "cdn.jsdelivr.net", "www.google.com", "raw.githubusercontent.com", "assets.coingecko.com", "t2.gstatic.com", "t1.gstatic.com", "t0.gstatic.com", "static.cloudflareinsights.com", "fonts.gstatic.com", "t3.gstatic.com", "fonts.googleapis.com", "icons.llamao.fi" ], "ips": [ "104.16.80.73", "104.17.208.5", "142.251.163.94", "172.253.122.104", "172.253.122.106", "142.251.163.103", "142.251.163.99", "142.251.150.119", "104.18.4.118", "185.199.108.133", "142.251.45.170", "172.67.158.30" ], "asns": [ "13335", "15169", "54113" ], "countries": [ "US" ], "doc_hash": "726447fe283becfd82a1eb9fc6f3d6323109db04d7aa9d3c0e2d853c0a57dac6", "script_hashes": [ "3f3fd1d2da308758a57f41dcd0fc587db7ab117ce928b9491cd34ebdfef384ea" ], "globals": [ "nav", "toggleDD", "KV", "toggleSidebar", "openCoinbaseStocks", "__cfBeacon", "openDD" ], "tls": { "san": [ "*.aave-pro.sbs", "aave-pro.sbs" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "aave-pro.sbs", "protocol": "TLS 1.3", "valid_to": "2027-01-14T09:51:35Z", "valid_from": "2026-10-16T09:51:36Z" }, "domain_age_days": 8, "apex_age_days": 8, "tls_age_days": 8, "tls_valid_days": 89, "requests": 98, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "aave" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Aave" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "cloudflare", "content-type": "text/html", "strict-transport-security": "max-age=63072000; includeSubDomains; preload", "content-security-policy": "frame-ancestors http: https:", "x-content-type-options": "nosniff" } }, "cf": { "v": 1, "fetched_at": "2026-10-25T02:37:22Z", "uuid": "0602a287-4d0f-48b3-8ece-e6ec7bed3aea", "scanned_at": "2026-10-25T02:34:39Z", "final_url": "https://aave-pro.sbs/", "status": 200, "history": [ { "url": "https://aave-pro.sbs/", "status": 200 } ], "dom_hash": "0d0e99e3266c7f8a98346f14f8d67bb8db0511304bcd92d6f00ec80f5b2b7414", "doc_hash": "726447fe283becfd82a1eb9fc6f3d6323109db04d7aa9d3c0e2d853c0a57dac6", "phishing_v2": [ "phishing" ], "domain_risks": [ "Newly Seen Domains", "Security Risks", "New Domains" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "aave-pro.sbs", "type": "A", "value": "188.114.97.0" }, { "name": "aave-pro.sbs", "type": "A", "value": "188.114.96.0" }, { "name": "aave-pro.sbs", "type": "AAAA", "value": "2a06:98c1:3120::" }, { "name": "aave-pro.sbs", "type": "AAAA", "value": "2a06:98c1:3121::" } ], "dnssec_valid": false, "ip": "188.114.97.0", "whois": { "registrar": "NameSilo, LLC", "created": "2026-10-16T09:54:27Z", "updated": "2026-10-16T10:02:18Z", "expires": "2027-10-16T23:59:59Z", "nameservers": [ "harley.ns.cloudflare.com", "novalee.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-25T03:38:58Z", "analysis_at": "2026-10-24T06:18:36Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 1, "undetected": 36 }, "detections": { "alphaMountain.ai": "suspicious" }, "reputation": 0, "categories": { "alphaMountain.ai": "Suspicious (alphaMountain.ai)" }, "registrar": "NameSilo, LLC", "created": "2026-10-16T09:54:27Z", "expires": "2027-10-16T23:59:59Z", "updated": "2026-10-16T10:02:18Z", "first_seen": "2026-10-16T10:55:55Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2606:4700:3035::6815:8ee" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3034::ac43:9e1e" }, { "ttl": 300, "type": "A", "value": "172.67.158.30" }, { "ttl": 21600, "type": "NS", "value": "novalee.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.8.238" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "harley.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "harley.ns.cloudflare.com" } ], "dns_at": "2026-10-24T06:49:23Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.aave-pro.sbs", "aave-pro.sbs" ], "issuer": "Let's Encrypt / YE2", "serial": "60081cc86e74727dfcbe9ae209bf55a006b", "sha256": "9f9267af563c74a2f0026236b558ed91cb3f01be435f43c5b8e92a3d86331e17", "subject": "aave-pro.sbs", "valid_to": "2027-01-14T09:51:35Z", "valid_from": "2026-10-16T09:51:36Z" }, "whois": { "registrar": "NameSilo, LLC", "registrar_iana_id": "1479", "registrar_url": "https://www.namesilo.com", "created": "2026-10-16T09:54:27Z", "updated": "2026-10-16T10:02:18Z", "expires": "2027-10-16T23:59:59Z", "status": [ "addPeriod", "clientTransferProhibited", "serverTransferProhibited" ], "nameservers": [ "harley.ns.cloudflare.com", "novalee.ns.cloudflare.com" ], "dnssec": "unsigned" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-25T02:40:44Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "aave-pro.sbs" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-25T01:58:47Z", "first": "2026-10-16T21:41:34Z", "changes": 2, "days_archived": 3, "scans_per_day": 0.24, "avg_page_bytes": 22162 }, "social_tags": { "title": "Aave Pro", "themeColor": "#000000" }, "trackers": { "requests": 64, "trackers": [ { "name": "Google", "company": "Google", "country": "US", "category": "Advertising", "requests": 7 }, { "name": "GitHub", "company": "GitHub, Inc.", "country": "US", "category": "Customer Interaction", "requests": 5 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 8 }, { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 19 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 3, "tls": 13, "wait": 101, "connect": 7, "download": 213 }, "response_ms": 337 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 218417, "co2_grams": 0.008, "cleaner_than": 5 }, "dns_server": { "ns": [ { "ip": "162.159.38.182", "host": "novalee.ns.cloudflare.com" }, { "ip": "172.64.35.128", "host": "harley.ns.cloudflare.com" } ], "zone": "aave-pro.sbs" }, "location": { "ip": "2a06:98c1:3120::3", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "aave-pro.sbs" }, "dns": { "A": [ "188.114.97.3", "188.114.96.3" ], "NS": [ "novalee.ns.cloudflare.com", "harley.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"harley.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417672816, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2a06:98c1:3121::3", "2a06:98c1:3120::3" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=63072000; includeSubDomains; preload", "message": "Site is compatible with the HSTS preload list!", "compatible": true }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": "1; mode=block", "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": "frame-ancestors http: https:", "strictTransportPolicy": "max-age=63072000; includeSubDomains; preload", "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3121::3", "family": 6 }, "redirects": { "chain": [ "https://aave-pro.sbs" ] }, "linked_pages": { "internal_count": 1 }, "whois": { "registrar": "NameSilo, LLC", "created": "2026-10-16T09:54:27Z", "updated": "2026-10-16T10:02:18Z", "expires": "2027-10-16T23:59:59Z", "status": [ "serverTransferProhibited https://icann.org/epp", "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "harley.ns.cloudflare.com", "novalee.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html", "strict-transport-security": "max-age=63072000; includeSubDomains; preload", "content-security-policy": "frame-ancestors http: https:", "x-content-type-options": "nosniff" } } } } ```