cardano-change[.]com

This domain is flagged as a high-risk brand impersonation threat targeting Aave, a decentralized finance protocol. The site presents itself as a Cardano-based cryptocurrency exchange offering services without Know Your Customer verification, a common tactic to lure users into disclosing sensitive credentials or transferring funds to fraudulent wallets. Analysis indicates the domain is designed to exploit trust in the Aave brand while bypassing regulatory safeguards, increasing exposure to financial fraud and account compromise. Infrastructure analysis reveals multiple concrete indicators of malicious activity. The domain cardano-change.com was registered on November 22, 2025, through SOLLUTIUM LLC, a registrar frequently associated with high-risk domains. It resolves to the IP address 62.182.84.46, located in Ukraine under AS6698 (Virtual Systems LLC), a network segment with a history of hosting phishing and scam operations. Security vendors on VirusTotal flagged the domain at a ratio of 17 out of 95, while it appears on four independent blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. The absence of an SSL certificate further undermines any pretense of legitimacy, as encrypted connections are a baseline requirement for financial platforms. The page title, 'Cardano Crypto Exchange Without KYC — Fast & Private,' reinforces the fraudulent narrative by appealing to users seeking anonymity. Mitigation steps for this threat type should focus on proactive blocking and user awareness. Network administrators are advised to implement DNS-level blocking for cardano-change.com and its associated IP address (62.182.84.46) to prevent access from corporate or institutional environments. End users should be educated to verify domain authenticity by cross-referencing official brand communications, particularly for platforms involving financial transactions. Given the domain's current offline status, monitoring for re-emergence under similar naming conventions (e.g., cardano-exchange, aave-cardano) is recommended. Organizations should also review logs for any prior connections to the IP or domain to assess potential exposure. For affected individuals, immediate password resets and wallet address verification are critical to mitigating further risk.