betsaves[.]com

The domain betsaves.com is a confirmed phishing site engaged in brand impersonation targeting Aave, a decentralized finance (DeFi) platform. This site operated as a DeFi scam, presenting itself as a legitimate Aave service to deceive users into connecting wallets or entering sensitive credentials. As of the latest verification, betsaves.com has been taken offline, but it previously posed an elevated risk of financial loss or credential theft.

Technical indicators confirm the malicious nature of betsaves.com. The domain was flagged by 1 of 95 security vendors on VirusTotal, including Gridinsoft, which assigned a trust score of 0/100. It appeared on one security blocklist (PhishDestroy) and was registered through Cosmotown, Inc. on April 23, 2025. The site resolved to the IP address 163.61.188.2, hosted on AS153568 (NEW DHAKA HARDWARE) in the US, and used an SSL certificate issued by Let's Encrypt (R12). Technologies detected included PHP, Bootstrap, LiteSpeed, and jQuery. The page title observed was 'Bet Saves - Home', and MX records pointed to betsaves.com with priority 0. Scamadviser assigned a trust score of 41/100, further indicating suspicious activity.

Users who interacted with betsaves.com should immediately revoke any token approvals granted to the site and transfer funds to a new, secure wallet. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication (2FA). Monitor accounts for unauthorized transactions or suspicious activity. Report the phishing domain to platforms such as Google Safe Browsing, PhishTank, or the impersonated brand (Aave) to aid in takedown efforts and protect other potential victims.