arcoin[.]global

This domain is under investigation for brand impersonation targeting Aave, a decentralized finance protocol. The threat type involves mimicking legitimate crypto services to deceive users into interacting with malicious smart contracts or disclosing wallet credentials. While no overt malware payloads have been confirmed, the infrastructure aligns with known crypto drainer or wallet-hijacking campaigns, particularly given the domain's focus on trading-related activity. Analysis reveals the domain arcoin.global was registered on June 19, 2025, through NameSilo, LLC, and resolves to IP address 104.21.80.1. It is currently offline but was previously active with the page title 'ArCoin - Trading Hub.' The domain appears on one security blocklist and is blocked by PhishDestroy. VirusTotal reports 0/95 detections, indicating no antivirus engines have flagged it yet, while Gridinsoft assigns a trust score of 0/100. Infrastructure analysis shows the use of Cloudflare for hosting, Zoho for backend services, and a Let's Encrypt SSL certificate, which are common in both legitimate and malicious deployments. Mitigation steps for this threat type include proactively blocking the domain and its resolving IP (104.21.80.1) at the network level. Organizations should monitor for user interactions with the domain, particularly in logs or transaction records involving crypto wallets. End users should be educated to verify domain authenticity before connecting wallets or entering credentials, especially when prompted by unsolicited trading or DeFi-related offers. Security teams are advised to correlate this domain with other Aave-themed impersonation attempts and check for overlapping infrastructure patterns.