A detailed threat hunting investigation into Prospero Networks (AS 200593) reveals a large-scale cryptocurrency exchange impersonation campaign. The analysis identifies over 200 malicious indicators across multiple ASNs, including fake crypto exchanges using names like "Yukitale" and "cryptavex." The research demonstrates advanced hunting techniques using DNS data and header analysis to uncover fresh, unreported infrastructure hosting phishing sites targeting crypto users, banking customers, and streaming services. The campaign spans multiple themes including cryptocurrency, Netflix/streaming, banking, and logistics phishing, with evidence suggesting coordination by Ukrainian threat actors.