cryptoswapnokyc[.]su

PhishDestroy has identified cryptoswapnokyc.su as a high-risk brand impersonation domain specifically targeting the decentralized finance protocol Aave. The site presented itself as a non-KYC crypto exchange under the title 'Non-KYC Crypto Exchange – Trade Crypto Anonymously & Fast,' aiming to lure users into a false sense of security while potentially stealing credentials or cryptocurrency. This malicious domain was registered through Cloudflare, Inc. and resolved to IP address 104.21.88.75, with an SSL certificate issued by Google Trust Services / WE1, adding a veneer of legitimacy.

Technical analysis reveals that this domain was flagged by 13 out of 95 security vendors on VirusTotal, indicating a consensus among cybersecurity tools regarding its malicious nature. It appeared on four security blocklists and was found in one threat intelligence pulse on AlienVault OTX. The domain's registration through Cloudflare, a reputable CDN provider, is a common tactic used by threat actors to obscure their true hosting location and evade takedown efforts. The page title explicitly advertised non-KYC trading, a hallmark of fraudulent crypto schemes designed to attract users seeking anonymity.

As of the latest check, cryptoswapnokyc.su has been taken offline, marking a successful disruption of this phishing infrastructure. However, the underlying threat persists as similar domains may resurface under different names or IP addresses. Users who may have interacted with this site should monitor their accounts for unauthorized activity and enable two-factor authentication. PhishDestroy recommends that Aave users and the broader crypto community remain cautious of any unsolicited offers for non-KYC services and always verify URLs through official sources before engaging.