localcoinswap[.]exchange

This domain, localcoinswap.exchange, was observed as an active cryptocurrency‑related scam site before being taken offline. The site’s page title advertised an “Anonymous No‑KYC Crypto Exchange — Buy & Sell Crypto Instantly,” a phrasing commonly used to lure users seeking anonymity. The intelligence explicitly lists Aave as the targeted brand, indicating a clear impersonation attempt. Registration data shows the domain was created on 11 August 2025 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED.

DNS resolution points to the IP address 172.67.149.174, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. No TLS certificate was observed for the domain, implying that the site operated without HTTPS protection. VirusTotal recorded a single positive detection out of ninety‑five scanners, and four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—have listed the domain as malicious. The current status is offline and nameserver information is not available.

The evidence strongly supports a brand‑impersonation crypto scam, though the limited VirusTotal positives and lack of encryption leave some uncertainty about additional payloads that may have been delivered. Defenders should block traffic to 172.67.149.174 and add localcoinswap.exchange to domain blocklists across email gateways, web proxies, and endpoint protection solutions. Monitoring for new domains registered through the same registrar or exhibiting similar lexical patterns is advised, as the operator may reuse the infrastructure. Continuous review of threat‑intel feeds for updates on this indicator is recommended, especially if the domain reappears or related domains targeting Aave users are observed.