aaveswapes-5cl[.]pages[.]dev

PhishDestroy identifies aaveswapes-5cl.pages.dev as an active fake-token drainer impersonating the Aave protocol. The site continues to operate under investigation and leverages brand confusion to trick users into connecting wallets. No drainer kit artifacts have been publicly extracted yet, but the domain’s cloaking behavior suggests real-time payload delivery. aaveswapes-5cl.pages.dev resolves to 188.114.96.3, carries a Google Trust Services SSL certificate, and was registered through Cloudflare, Inc. The domain went live on an undetermined date, currently sits at 2/95 on VirusTotal with zero blocklist detections, and has not yet been marked malicious by Google Safe Browsing. Registrar privacy masking prevents creation-date disclosure. The threat remains active until takedown. Users should avoid the domain entirely and treat any Aave-related giveaway links referencing aaveswapes-5cl.pages.dev as fraudulent. Remaining risk is medium while the site remains accessible and unblocked.