aave[.]com-v3-airdrop[.]live

This domain, aave.com-v3-airdrop.live, poses a direct threat to users of the Aave decentralized finance protocol by impersonating its official branding to deploy crypto drainer malware. The site mimics Aave’s legitimate interface, presenting itself as an airdrop or protocol update page under the title 'Aave - Open Source Liquidity Protocol.' Victims lured into connecting their cryptocurrency wallets risk unauthorized transactions that siphon funds to attacker-controlled addresses, a tactic commonly associated with crypto drainer phishing campaigns. The threat is particularly insidious due to its use of familiar branding and technical jargon to lower user suspicion. Analysis indicates the domain was flagged by 2 out of 95 security vendors on VirusTotal, a relatively low detection rate that underscores its evasive design. Infrastructure analysis reveals the domain resolved to the IP address 172.67.140.170, a Cloudflare-associated endpoint, and was registered through Cloudflare, Inc. The domain appears on one security blocklist and was assigned a trust score of 0/100 by Gridinsoft, further confirming its malicious nature. Despite its current offline status, the domain’s infrastructure and registration details align with patterns observed in active crypto drainer operations. Users who visited aave.com-v3-airdrop.live or interacted with its content should immediately revoke any wallet permissions granted to the site. This can be done via wallet management interfaces under 'connected sites' or 'authorized dApps.' Affected individuals should also transfer remaining assets to a new wallet address and monitor their transaction history for unauthorized activity. Given the domain’s association with crypto drainer malware, it is critical to assume any connected wallet may be compromised. Users are advised to avoid interacting with unsolicited airdrop promotions or protocol updates, particularly those disseminated via social media or unofficial channels.