kavaverifyrbot[.]pages[.]dev

PhishDestroy identifies kavaverifyrbot.pages.dev as an active crypto drainer domain impersonating the Aave brand to deceive users into connecting malicious wallets. This domain is currently operational and leverages social engineering tactics to trick victims into transferring cryptocurrency assets under the guise of legitimate Aave protocol interactions. The threat actor behind this domain has deployed infrastructure designed to exploit users seeking to engage with Aave’s services, with a primary focus on draining digital assets from connected wallets.

This domain was flagged by 0 of 95 VirusTotal vendors, indicating limited detection coverage despite hosting malicious content. Registered through Cloudflare, Inc., it resolves to IP address 172.66.47.37 and is associated with a Google Trust Services SSL certificate. The domain has been confirmed to appear on 3 security blocklists and is blocked by ScamSniffer, Enkrypt, and OISD. Google Safe Browsing categorizes the site under SOCIAL_ENGINEERING, reflecting its deceptive intent.

Users are advised to avoid interacting with kavaverifyrbot.pages.dev and to verify the legitimacy of any Aave-related domains using PhishDestroy. Given the elevated risk level and the domain’s engagement in crypto drainer activity, immediate precautions should be taken to prevent potential financial loss. Security researchers are encouraged to monitor this domain for further updates and to report any new findings to relevant threat intelligence platforms.