coinrave[.]top

This domain is flagged as a high-risk brand impersonation threat specifically targeting users of the Aave decentralized finance protocol. The site employs credential harvesting techniques combined with wallet-draining smart contracts to compromise cryptocurrency holdings, representing a direct financial risk to victims who connect their wallets or enter recovery phrases. Analysis indicates the domain coinrave.top was registered on July 14, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with malicious infrastructure. The domain currently resolves to IP address 104.21.52.69, which falls within Cloudflare's IP range, a common evasion tactic to mask hosting origins. VirusTotal detection metrics show 9 out of 95 security vendors flagging the domain as malicious, with specific classifications including phishing, brand impersonation, and cryptocurrency theft. The SSL certificate issued by Google Trust Services provides a false sense of legitimacy while facilitating encrypted communication for credential exfiltration. No blocklist entries were observed in major threat intelligence feeds at the time of analysis, suggesting this is a recently deployed campaign still gaining detection coverage. Mitigation requires immediate action from both end users and security teams. Users should verify domain authenticity by cross-referencing official Aave communication channels before connecting wallets or entering sensitive information. Security teams should implement domain-based blocking at the network level for coinrave.top and monitor for connections to 104.21.52.69. Wallet providers are advised to add this domain to their phishing detection databases and warn users attempting to connect. Given the high-risk nature of cryptocurrency theft, affected users should immediately revoke any connected wallet permissions and transfer assets to new secure wallets. Organizations should treat this as an active threat requiring immediate containment measures.