5pejwv4s7bbb4w5gcfnpnuyvtr4qgwxl6rhyms6rlrahtdalrctq[.]arweave[.]net

This domain, 5pejwv4s7bbb4w5gcfnpnuyvtr4qgwxl6rhyms6rlrahtdalrctq.arweave.net, poses an elevated-risk brand impersonation threat targeting Aave users through a cryptocurrency drainer scheme. Analysis indicates the infrastructure is designed to mimic legitimate Aave interfaces, likely prompting visitors to connect wallets or input recovery phrases. The attack vector typically involves fake login portals or malicious smart contract interactions, which drain funds from connected wallets upon user authorization. The domain’s technical setup suggests a focus on DeFi users, exploiting trust in the Aave brand to execute unauthorized transactions. Evidence supporting this assessment includes detection by 2 out of 95 security vendors on VirusTotal, registration through NameCheap, Inc. on June 08, 2026, and resolution to the IP address 79.127.216.204. The domain appears on 3 security blocklists and was proactively blocked by multiple wallet security providers. Its SSL certificate, issued by Let’s Encrypt, does not mitigate the malicious intent, as the domain was taken offline following detection. The unique seed identifier for this campaign is 73521e, which may correlate with other related infrastructure. Users who visited this domain should immediately revoke any wallet permissions granted during the interaction. Check connected applications in wallet settings and remove any unfamiliar or suspicious entries. Monitor transaction history for unauthorized activity and transfer remaining assets to a new wallet if compromise is suspected. Avoid interacting with any links or prompts from the domain, even if the site appears inactive. Report the incident to relevant security teams and consider submitting the domain to additional threat intelligence platforms for broader awareness.