swapspace[.]exchange

Analysis of swapspace.exchange indicates a high‑risk brand‑impersonation campaign targeting users of the Aave platform. The domain was registered on August 11, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 104.21.80.1, which belongs to AS13335 Cloudflare, Inc. in the United States. No SSL certificate was observed, suggesting the site operated over plain HTTP. The hosted page title – “SwapSpace — Instant Crypto Exchange Without KYC or Registration” – aligns with the declared scam type of a crypto scam and does not reference Aave directly, yet the domain is flagged for impersonating the Aave brand.

Reputation data shows a Gridinsoft trust score of 0 out of 100, confirming a lack of legitimacy. The domain appears on four security blocklists (PhishDestroy, Polkadot, Enkrypt, and Codeesura) and has been flagged by 13 of 95 vendors on VirusTotal, reinforcing its malicious nature. Current status is offline, but historical evidence suggests it was previously active and served malicious content.

Defenders should block the domain at network perimeters, update DNS filtering rules, and monitor for any residual traffic to the associated Cloudflare IP. Additional investigation of related sub‑domains or similar registrations by the same registrar may uncover further infrastructure. Because the site is no longer reachable, remediation focuses on preventive controls and threat‑intel sharing to mitigate future impersonation attempts against Aave users.