toswap[.]us

toswap.us is a phishing domain engaged in brand impersonation targeting the Telegram brand. It presents itself as a decentralized cryptocurrency privacy mixer to lure victims into a cryptocurrency scam. The site is currently taken offline, reducing immediate risk but the domain remains a threat indicator for ongoing investigations into brand impersonation scams involving cryptocurrency.

toswap.us was registered on June 03, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IP address 104.21.16.66 located in the United States under AS13335 Cloudflare, Inc. The domain is flagged by 1 of 95 VirusTotal security vendors, including alphaMountain.ai, and appears on 1 security blocklist, PhishDestroy. It lacks an SSL certificate and its page title was observed as 'ToSwap - Decentralized Cryptocurrency Privacy Mixer | Secure Anonymous Exchange.' The domain uses Cloudflare nameservers jacqueline.ns.cloudflare.com and julio.ns.cloudflare.com and currently returns HTTP status 429.

Users who suspect they have interacted with toswap.us should immediately move any cryptocurrency holdings to new wallets if possible and revoke any token approvals granted. Since this is a cryptocurrency scam involving brand impersonation, victims should remain vigilant for related phishing attempts and monitor accounts for unauthorized activity. To report incidents related to toswap.us, users can contact relevant cybersecurity authorities and submit samples to threat intelligence platforms to aid in blocking and mitigation efforts.