m[.]ra-ie[.]top

This domain, m.ra-ie.top, is actively impersonating Ethereum to deploy a crypto drainer, a threat designed to siphon cryptocurrency from victims' wallets. The site mimics legitimate Ethereum interfaces, tricking users into connecting their wallets or entering recovery phrases. Once compromised, funds are irreversibly transferred to attacker-controlled addresses, often within minutes of interaction. Analysis indicates the domain was registered on February 09, 2025, through NameSilo, LLC. It is currently hosted on Cloudflare infrastructure (IP: 188.114.96.3, AS13335) and lacks an SSL certificate, a red flag for secure connections. Security vendors on VirusTotal flagged the domain as malicious, with 3 out of 95 engines detecting it. Additionally, it appears on one security blocklist, further confirming its malicious intent. If you visited m.ra-ie.top, immediately disconnect any connected wallets from the site. Revoke all active wallet permissions using a trusted blockchain explorer. Transfer remaining funds to a new, secure wallet and monitor past transactions for unauthorized activity. Enable multi-factor authentication on all crypto-related accounts and consider reporting the incident to relevant security teams or platforms. Do not reuse passwords or recovery phrases from compromised accounts.