aaveswap[.]app

This domain, aaveswap.app, is flagged as a high-risk brand impersonation threat targeting Aave, a decentralized finance lending protocol. Analysis indicates the site replicates the official Aave interface, presenting itself under the page title 'Aave - Open Source DeFi Lending Protocol.' No direct evidence of a drainer kit has been identified, but the domain’s structure and content align with known DeFi phishing tactics designed to harvest credentials or wallet connections. Infrastructure analysis reveals the domain was registered on April 09, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu. It resolves to the IP address 43.174.241.1 and is secured by an SSL certificate issued by TrustAsia Technologies, Inc. VirusTotal reports 16 out of 95 security vendors flagging the domain as malicious. The domain appears on three security blocklists, including MetaMask and PhishDestroy, and holds a Gridinsoft trust score of 0/100. Google Safe Browsing (GSB) status is not explicitly provided, but the domain’s inclusion in multiple blocklists suggests active detection. As of the latest assessment, aaveswap.app has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the domain’s registration remains active, posing a residual risk of reactivation. Users who interacted with the site should revoke any connected wallet permissions and monitor for unauthorized transactions. Organizations are advised to update blocklists and alert users to the impersonation attempt, particularly within DeFi communities where Aave is widely used.