swapdaypro-nl[.]live

The domain swapdaypro-nl.live was registered on May 09, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. Its public‑facing title reads “Swap Daypro | Officieel Platform voor AI‑ondersteunde Handel”, which mimics a legitimate trading platform and aligns with the observed fake‑exchange phishing pattern. The site is currently active and returns HTTP 200 for all requests. Technical infrastructure shows the domain is served behind Cloudflare, using the authoritative nameservers arnold.ns.cloudflare.com and annabel.ns.cloudflare.com. The resolved address 104.21.28.127 maps to a Cloudflare data centre in Canada. TLS is provided by Let’s Encrypt (certificate identifier E8), and the connection presents a valid certificate chain. Gridinsoft assigns a trust score of 0 / 100, and four of ninety‑five VirusTotal scanners have flagged the host as malicious. Threat intelligence indicates the site is listed on one security blocklist and is actively blocked by PhishDestroy. AlienVault OTX references the domain in a single pulse, corroborating its classification as a fake‑exchange scam. The combination of a low trust score, multiple vendor detections, and the use of an official‑sounding Dutch title suggests a coordinated attempt to lure victims into credential or financial theft. No additional payload samples or command‑and‑control infrastructure have been observed, leaving the full malicious capability unknown. Defenders should add swapdaypro‑nl.live to web‑filter and DNS‑allow‑list deny rules, and monitor outbound connections to the associated Cloudflare IP for anomalous traffic. Because the domain uses a reputable CDN, response‑based blocking may be required to avoid collateral impact on other tenants. Continuous threat‑intel feeds should be consulted for any emerging indicators, and incident response teams should be prepared to investigate any credential submissions or payment requests that reference this domain.