naveenrajhari[.]github[.]io

This domain, naveenrajhari.github.io, poses a high-risk brand impersonation threat targeting Aave, a decentralized finance protocol. Analysis indicates the site is designed to deceive users into believing they are interacting with the legitimate Aave platform, likely to facilitate credential harvesting or unauthorized transactions. The domain leverages GitHub Pages infrastructure, a common tactic to evade detection and exploit trust in well-known hosting providers. The page currently displays a 'Site not found' message, which may indicate either a temporary placeholder or an attempt to avoid immediate scrutiny while maintaining operational readiness for malicious campaigns. Evidence supporting the malicious classification includes detection by 7 out of 95 security vendors on VirusTotal, with the domain appearing on at least one security blocklist. Infrastructure analysis reveals the domain is registered through GitHub Pages and resolves to the IP address 185.199.110.153, hosted under AS54113 (Fastly, Inc.) in the United States. The SSL certificate is issued by Let's Encrypt (R12), a detail often exploited by threat actors to lend a false sense of legitimacy. Despite the benign appearance of the current page title, historical or contextual data suggests prior or intended malicious activity, particularly given the specific targeting of Aave users. Users who have visited naveenrajhari.github.io should immediately revoke any active sessions or authorizations associated with Aave or other decentralized finance platforms. If credentials or wallet information were entered, affected parties must transfer assets to a new, secure wallet and monitor for unauthorized transactions. Browser data, including cookies and cached content, should be cleared to eliminate residual tracking or session persistence. Network-level blocking of the domain and its resolving IP (185.199.110.153) is recommended to prevent further exposure. Organizations should update internal blocklists and alert users to the impersonation risk, particularly those engaging with cryptocurrency or DeFi services.