coinswap[.]ac

Analysis on July 24 2026 identifies the domain coinswap.ac as a high‑risk brand‑impersonation site targeting the Ethereum community. The domain was registered on 10 July 2025 through NiceNIC International Group Co., Limited and resolves to the IP address 104.21.112.1, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 root, indicating a valid HTTPS connection despite its malicious purpose. Google Safe Browsing has flagged the URL for social‑engineering, and the domain appears on a single security blocklist as well as being blocked by PhishDestroy.

VirusTotal scans show that 10 of 95 security vendors have raised detections, reinforcing the malicious classification. The page title advertised by the site – “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | coinswap” – is consistent with a crypto‑exchange façade, and the content is built on Node.js, Vue.js, Nuxt.js and related front‑end libraries, with additional third‑party resources such as jsDelivr, cdnjs, and a Facebook Pixel, all delivered behind Cloudflare’s CDN. The Gridinsoft trust score of 0 out of 100 further indicates a lack of legitimacy.

The site is currently offline, but its prior activity demonstrates a pattern of impersonating the Ethereum brand to lure users into a crypto‑scam. Defenders should continue to block the domain at network perimeter, monitor for any re‑hosting on other Cloudflare IPs, and update URL‑filtering and email‑security policies to reject references to the page title or the “coinswap” keyword. Additional investigation of the associated IP and the hosting provider may reveal other malicious assets that share the same infrastructure.