coinlist-lake[.]vercel[.]app

This domain operates as a fraudulent imitation of the Aave decentralized finance platform, designed to deceive users into entering sensitive credentials such as wallet private keys or recovery phrases. The site mimics legitimate Aave interfaces, likely prompting victims to connect wallets or input authentication details under false pretenses, leading to immediate asset theft or account compromise. Analysis indicates the domain leverages social engineering tactics typical of cryptocurrency phishing, targeting users familiar with Aave’s branding and services. Infrastructure analysis reveals the domain is hosted on Vercel Inc. infrastructure and resolves to IP address 64.29.17.67, located within Amazon.com, Inc.’s AS16509 network in the United States. The SSL certificate, issued by Google Trust Services (WR1), adds a false layer of legitimacy. As of the latest scan, 11 out of 95 security vendors on VirusTotal have flagged the domain as malicious, while Google Safe Browsing classifies it as phishing. The domain appears on one security blocklist, specifically PhishDestroy, and remains active despite detection. Users who have visited coinlist-lake.vercel.app should immediately disconnect any connected wallets and cease all interaction with the site. If credentials or private keys were entered, affected users must transfer assets to a new, secure wallet and revoke any active approvals or sessions linked to the compromised account. Monitor all connected accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to relevant security teams or abuse contacts, including the hosting provider (Vercel Inc.) and domain registrars, to aid in takedown efforts.