corenova[.]uk

This domain is flagged as an elevated-risk brand impersonation threat, specifically targeting Compound, a decentralized finance protocol. The site operated under the page title 'CoreNova,' mimicking legitimate branding to deceive users into interacting with fraudulent services or disclosing sensitive credentials. Analysis indicates a deliberate attempt to exploit trust in the targeted brand, likely for financial fraud or unauthorized access to crypto assets.

Infrastructure analysis reveals the domain was registered on August 04, 2025, through Realtime Register BV t/a Axidomains. It resolved to IP address 82.29.191.24 and employed technologies including LiteSpeed and Hostinger. Security vendors flagged the domain in 2 of 95 VirusTotal scans, while Scamadviser and Gridinsoft assigned trust scores of 1/100. The domain appeared on one security blocklist and was actively blocked by PhishDestroy. Its current status is offline, but historical activity warrants monitoring.

Mitigation steps for this brand impersonation threat include immediate blacklisting of the domain and IP across security gateways. Organizations should monitor for similar domain registrations (e.g., typosquatting, lookalike names) and implement DNS-based blocking for known malicious infrastructure. Users interacting with Compound or related services should verify domain authenticity via official channels and enable multi-factor authentication. Security teams are advised to conduct retrospective log analysis for connections to 82.29.191.24 or the domain prior to takedown.