bhaveshkransan[.]github[.]io

PhishDestroy identifies bhaveshkransan.github.io as an active brand impersonation site targeting users of the Aave DeFi protocol. The page mimics Aave’s branding to trick visitors into connecting cryptocurrency wallets or submitting sensitive data such as seed phrases and private keys. Because the attackers’ goal is to steal digital assets or harvest credentials for later account takeovers, visiting this site can lead to irreversible financial loss.

This domain was flagged by 3 out of 95 VirusTotal security vendors and is served from IP address 185.199.108.153 behind a Let’s Encrypt SSL certificate. It is hosted on GitHub Pages under the account bhaveshkransan, a pattern commonly abused for low-cost impersonation campaigns against decentralized finance projects. The site’s content closely mirrors legitimate Aave interfaces, increasing the risk of accidental interaction.

If you already visited bhaveshkransan.github.io, immediately disconnect any connected wallets, revoke any permissions you may have granted, and run a malware scan on your device. Do not enter credentials or seed phrases on the page. Report the URL to Aave’s official security team and consider rotating wallet addresses and keys used for DeFi interactions. Always verify site URLs against official Aave channels before entering sensitive information.