aave-compensation[.]eth[.]limo

PhishDestroy identifies aave-compensation.eth.limo as an active crypto drainer impersonating the Aave protocol, leveraging brand confusion to steal cryptocurrency. This Ethereum Name Service subdomain (eth.limo gateway) mimics legitimate Aave compensation portals to deceive users into connecting wallets and approving malicious transactions. The site instructs visitors to 'claim compensation' while silently draining funds through compromised smart contract interactions – a hallmark of crypto drainer campaigns targeting DeFi users. Investigative data reveals this domain is a brand impersonation threat resolving to IP 3.135.72.151, with a Let's Encrypt SSL certificate typically used to appear legitimate. VirusTotal currently shows 9/95 security engine detections, indicating it remains undetected by most antivirus solutions. The domain remains active despite the security community's ongoing monitoring, suggesting it may be recently deployed or using evasion tactics. Attribution remains under investigation as researchers analyze its infrastructure and associated wallet addresses. If you visited aave-compensation.eth.limo, immediately revoke any wallet connection permissions through tools like Revoke.cash or your wallet's connection manager. Do not interact with any pending transactions – your funds may already be at risk. Consider transferring remaining assets to a fresh wallet address. Report the domain to security platforms like Google Safe Browsing or PhishDestroy to help block future attacks against other users.