heavenmarketing[.]pk

This domain, heavenmarketing.pk, is confirmed as a brand impersonation site targeting Aave, a decentralized finance protocol. Analysis indicates the site was designed to mimic legitimate Aave interfaces, likely to facilitate unauthorized cryptocurrency transactions or credential harvesting. No specific drainer kit signatures were identified in available telemetry, but the domain structure and content align with known impersonation tactics used in crypto-related fraud schemes. Technical indicators reveal the domain was flagged by 5 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100 and a Scamadviser score of 1/100. The domain was registered on April 28, 2026, and resolved to the IP address 162.0.232.43. It appears on three security blocklists and was included in one AlienVault OTX threat intelligence pulse. The registrar details are not publicly disclosed, but the domain's creation date suggests it was deployed with malicious intent shortly after registration. Google Safe Browsing status is not explicitly noted, but the domain's presence on multiple blocklists confirms its classification as malicious. As of the latest assessment, heavenmarketing.pk has been taken offline, reducing immediate exposure risk. However, the infrastructure associated with the IP address (162.0.232.43) may still pose residual threats, as it could be reused for future malicious campaigns. Organizations and users are advised to block the domain and its associated IP at the network level. Monitoring for similar impersonation domains targeting Aave or other decentralized finance platforms is recommended, particularly those registered under suspicious TLDs or with recent creation dates. Users who interacted with the domain should revoke any connected wallet permissions and audit transaction histories for unauthorized activity.