monero-exchange-swap[.]com

The domain monero-exchange-swap.com was registered on February 21, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 172.67.175.223, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Gridinsoft assigns the domain a trust score of 0 out of 100, indicating a malicious reputation. The site is currently reported as offline, and the SSL certificate presented is identified as WE1. Six of ninety‑three VirusTotal scanners flag the domain, confirming the presence of malicious indicators.

The domain appears on four security blocklists, specifically PhishDestroy, Polkadot, Enkrypt, and Codeesura, all of which have taken the domain down. The page title returned by the server is “Monero Exchange Swap – Anonymous XMR Crypto Exchange”, which aligns with the declared scam type of a crypto scam. The domain is explicitly listed as impersonating the brand aave, suggesting a targeted brand‑impersonation campaign aimed at users of that platform. No additional payload, click‑through URLs, or credential‑harvesting forms have been publicly disclosed, and the exact content of the hosted page beyond the title has not been analyzed; consequently, the full attack vector and potential victim impact remain unclear. Defenders should immediately block traffic to 172.67.175.223 and add monero-exchange-swap.com to local DNS blacklists.

Monitoring for newly registered domains that share the “monero‑exchange‑swap” lexical pattern or that resolve to Cloudflare AS13335 may provide early warning of similar campaigns. Because the domain uses a legitimate CDN provider, reliance on IP‑based blocking alone could affect benign services; therefore a combination of domain‑level filtering and inspection of HTTP responses for the specific page title is recommended. Continuous re‑scanning with VirusTotal or other multi‑engine services is advised to capture any future changes in the detection profile.