naveshwar2123[.]github[.]io

PhishDestroy identifies active brand impersonation on the domain naveshwar2123.github.io that masquerades as the legitimate Aave platform to harvest user credentials and private keys. The page is designed to mirror Aave’s official interface, tricking visitors into connecting digital wallets or entering seed phrases. Once credentials or private keys are submitted, attackers gain direct control over victims’ crypto assets, leading to irreversible financial loss and potential compromise of associated DeFi protocols and accounts.

This domain was flagged by 13 of 95 VirusTotal security vendors at the time of analysis, indicating elevated malicious activity. It resolves to GitHub-hosted infrastructure (IP 185.199.109.153) and is registered through GitHub, Inc., leveraging the platform’s trusted SSL certificate authority (Let’s Encrypt) to appear legitimate. Given its recent activation and detected abuse signatures, it poses a high risk of exploitation within active threat campaigns targeting DeFi users, particularly those engaged with Aave’s ecosystem.

If you visited naveshwar2123.github.io or entered any credentials or private keys, immediately revoke wallet permissions using tools such as Etherscan’s Token Approval tool or similar blockchain scanners. Transfer remaining funds to a new, isolated wallet and enable multi-factor authentication where available. Report the domain to your security team and block it at the network level. Monitor accounts closely for unauthorized transactions, and consider using hardware wallets for enhanced protection against future impersonation attacks.