mvad4xgge7fgo4o3oawjdf6276xl2cabpl5upoie6wnltqg7nyzq[.]arweave[.]net

This domain, mvad4xgge7fgo4o3oawjdf6276xl2cabpl5upoie6wnltqg7nyzq.arweave.net, operates as a high-risk crypto drainer targeting users of the Aave decentralized finance platform. Analysis indicates the site is designed to mimic legitimate Aave interfaces, tricking victims into connecting wallets and signing malicious transactions that drain funds. The page title 'Loading…' suggests an attempt to appear as a legitimate loading screen while executing unauthorized smart contract interactions in the background. Infrastructure analysis reveals the domain was created on June 08, 2026, and is registered through NameCheap, Inc. It resolves to the IP address 79.127.216.204 and is currently flagged by 3 out of 95 security vendors on VirusTotal. The domain appears on three security blocklists and is actively blocked by multiple wallet security providers. The SSL certificate is issued by Let's Encrypt, serial number E8, which does not mitigate the underlying threat. Users who have visited this domain or interacted with its content should immediately disconnect any connected wallets from the site. Review all recent wallet transactions for unauthorized activity, particularly those involving token approvals or contract interactions. Revoke any suspicious smart contract allowances using a blockchain explorer or dedicated revocation tool. Monitor connected accounts for signs of compromise and consider migrating assets to a new wallet if unauthorized access is confirmed. Report the incident to relevant security teams for further analysis and potential takedown coordination.