v4-swapnetwork[.]cc

v4-swapnetwork.cc was registered on September 8 2025 through NiceNIC International Group Co., Limited and is currently listed as offline. The domain resolves to the Cloudflare address 172.67.187.55, which belongs to AS13335 Cloudflare, Inc. in the United States. Nameserver records point to cheryl.ns.cloudflare.com and morgan.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. No TLS certificate was observed for the host, meaning HTTPS connections would be unencrypted or invalid.

The only visible HTML element is the page title “Website Created,” providing no substantive content about the site’s purpose. Security telemetry shows the domain is associated with a crypto‑scam that impersonates the Celer brand. Twelve of ninety‑five security vendors on VirusTotal flagged the domain, indicating a moderate level of detection across multiple scanners. The domain appears on one external blocklist and is specifically blocked by PhishDestroy, confirming that at least one dedicated anti‑phishing service has taken action against it.

Gridinsoft assigned a trust score of 0 out of 100, reinforcing the low confidence in the domain’s legitimacy. While the infrastructure details (Cloudflare hosting, lack of TLS, and registrar) are clear, the exact payload or landing page used in the campaign cannot be confirmed because the site is offline and no further content has been captured. Defenders should continue to block the domain at perimeter filters, verify that any outbound connections to 172.67.187.55 are denied, and monitor for related Celer‑brand impersonation attempts. Updating URL filtering lists with the domain and its associated IP, and enforcing TLS inspection policies to catch future attempts that may use similar Cloudflare‑hosted infrastructure, are recommended mitigation steps.