aaveswap[.]us

This domain, aaveswap.us, is flagged as an active brand impersonation threat targeting users of the Aave decentralized finance protocol. Analysis indicates the site mimics Aave’s legitimate swap interface, presenting itself as 'Aave Swap : Ethereum & Avalanche' to deceive users into connecting wallets or entering sensitive credentials. The domain specifically exploits the trust associated with Aave’s brand to facilitate cryptocurrency theft, likely through fake smart contract interactions or credential harvesting forms. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on April 09, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu, and resolves to IP address 43.174.246.23 located in Singapore under AS139341 (ACE). Security vendors on VirusTotal flag the domain as malicious, with 2 out of 95 engines detecting it. The site appears on three independent security blocklists and is actively blocked by wallet security layers and domain reputation systems. The SSL certificate, issued by TrustAsia Technologies, Inc., does not mitigate the risk, as phishing sites commonly use valid certificates to appear legitimate. Users who have visited aaveswap.us should immediately disconnect any connected wallets and revoke permissions for associated smart contracts. It is recommended to scan local devices for malware, as phishing sites may deploy additional payloads. Cryptocurrency transactions initiated through this domain should be treated as compromised, and users should monitor wallet addresses for unauthorized activity. If credentials or private keys were entered, affected accounts must be migrated to new secure wallets, and all linked services should be reviewed for signs of unauthorized access. The domain remains active as of this assessment, underscoring the need for heightened vigilance in decentralized finance interactions.