claim-windheaven[.]xyz

PhishDestroy has identified claim-windheaven.xyz as an active brand impersonation threat specifically targeting users of the Aave decentralized finance protocol. This domain was engaged in a crypto drainer operation designed to steal digital assets, and it has now been taken offline. The site displayed a page title of "Truth Social," which is entirely unrelated to the legitimate Aave platform, and was registered on February 21, 2026, making it a very recent creation.

Technical analysis reveals that claim-windheaven.xyz resolved to IP address 178.208.83.16 and was flagged by 7 out of 95 security vendors on VirusTotal, indicating widespread detection. Google Safe Browsing listed it as a phishing site, and it appeared on 4 distinct security blocklists. AlienVault OTX tracked it in one threat intelligence pulse, and the SSL certificate was issued by R13. The domain was registered through an unverified registrar, consistent with malicious registrations.

Despite being taken offline, users should remain vigilant. PhishDestroy recommends that anyone who interacted with claim-windheaven.xyz immediately revoke any permissions granted and transfer remaining funds to a new wallet. Always verify URLs before connecting crypto wallets, and use PhishDestroy's free scanning tool to check suspicious domains. Stay safe by only accessing Aave through its official website and official communication channels.