rangoexch-ange[.]github[.]io

This domain, rangoexch-ange.github.io, is actively engaged in brand impersonation targeting the Aave decentralized finance protocol. Analysis confirms the domain is currently live and operational, presenting itself as an official platform to deceive users into disclosing sensitive credentials or transferring assets. The threat type is classified as brand impersonation, a tactic commonly employed to exploit trust in established cryptocurrency services. Infrastructure analysis reveals the domain is registered through GitHub Pages and resolves to the IP address 185.199.108.153, located within the United States under AS54113 (Fastly, Inc.). The SSL certificate is issued by Let's Encrypt (R12), a common but non-exclusive indicator of legitimacy. Security telemetry indicates the domain is flagged by 3 of 95 vendors on VirusTotal, with additional detections from PhishDestroy and Google Safe Browsing, which explicitly categorizes it as phishing. The domain appears on one security blocklist, and its page title, 'Rango Exchange - Official Site☠️,' includes overtly deceptive branding elements, such as the skull emoji, to mimic authenticity. Current status remains active, posing a high risk to users unfamiliar with Aave's legitimate domains. Immediate mitigation steps include blocking the domain at the network level, updating endpoint protection rules to include the IP 185.199.108.153, and alerting users to verify domain authenticity before interacting with any Aave-related services. Organizations should monitor for connections to this IP or domain in logs and investigate any associated activity. Users are advised to cross-reference official communications from Aave for legitimate domain information and report any suspicious links to their security teams.