uhzkti5r2kz2tpccifev3qkuj67mte5vhhghvyu5lf6haozugczq[.]arweave[.]net

PhishDestroy identifies an active brand impersonation threat targeting Aave users on a deceptive domain hosted on the Arweave decentralized storage network. The page is designed to mimic legitimate Aave interfaces, tricking visitors into entering sensitive wallet credentials or transaction details. Security systems like MetaMask and SEAL have already blocked access to this domain, but its presence on two blocklists underscores the ongoing risk. The domain’s obfuscated structure and use of a loading state delay page reveal a deliberate attempt to evade detection while harvesting user data or funds. This domain was flagged with the unique seed d18b87 and shows clear indicators of malicious intent. The VirusTotal scan returned 0 detections out of 95 engines, highlighting how new or evasive this threat is. While the SSL certificate is issued by Let’s Encrypt, a common practice for both legitimate and malicious sites, the domain’s recent creation and obscure naming convention (64-character alphanumeric prefix) are red flags. The Arweave network, while legitimate, provides an ideal environment for hosting persistent phishing content due to its decentralized and censorship-resistant nature. The page’s misleading title, “Loading…”, masks its true purpose, delaying user suspicion until it’s too late. If you visited this domain, do not enter any wallet addresses, private keys, or transaction details. Disconnect from the site immediately and revoke any permissions granted to connected wallets through your wallet provider’s interface. Scan your device with updated antivirus software and consider using a hardware wallet for added security. Report the domain to Aave’s official security channels and share this intelligence with your network to prevent further victimization. Stay vigilant: always verify URLs, use bookmarks for known platforms, and enable transaction simulation tools to detect fraudulent activity before approval.