hqswap[.]cc

The domain hqswap.cc was registered on 21 February 2026 through NETIM SAS. DNS resolution points to 172.67.130.225, an address owned by AS13335 Cloudflare, Inc., located in the United States. The site was served behind Cloudflare's edge network, exposing HTTP/3 support, and presented an SSL certificate issued by Google Trust Services under the WE1 intermediate, indicating a valid TLS handshake at the time of capture. A VirusTotal scan recorded four detections out of ninety‑three scanners, and the domain is listed on a single security blocklist.

PhishDestroy has actively blocked the host, and the page title returned during probing was "hqswap.cc | 522: Connection timed out", consistent with a service‑unavailable response. The only publicly observed activity aligns with a crypto‑scam classification; no additional payload or credential‑harvesting pages have been recovered. Current monitoring shows the site taken offline, but the infrastructure—particularly the Cloudflare front‑end and the underlying IP address—remains usable for future campaigns.

Defenders should continue to enforce deny‑list rules for the 172.67.130.225 address range and the hqswap.cc domain, monitor TLS certificate changes for rapid re‑use, and incorporate the observed indicators into endpoint and network detection policies. Because the hosting environment is shared, related malicious actors could reuse the same IP block, so broader Cloudflare‑ASN monitoring is advised. Uncertainty remains regarding the exact phishing landing page content and any associated command‑and‑control hosts, which have not been disclosed in the available data.