xcoinswap[.]io

The domain xcoinswap.io was identified as a phishing site engaged in brand impersonation, specifically targeting users of Binance. This domain was used as part of a cryptocurrency scam, aiming to deceive individuals by mimicking Binance branding. As of now, xcoinswap.io has been taken offline and is no longer accessible, but it previously posed an elevated risk to users searching for legitimate cryptocurrency services.

Technical analysis shows that xcoinswap.io was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on February 21, 2026, and resolved to IP address 104.21.41.170, located in the US under AS13335 (Cloudflare, Inc.). The site did not use an SSL certificate and had the page title X Wallet. Detection rates were low, with only 1 of 95 security vendors on VirusTotal (including SOCRadar) flagging the domain. However, it appears on three security blocklists: PhishDestroy, MetaMask, and SEAL. The site used Cloudflare and HTTP/3 technologies, and nameservers dakota.ns.cloudflare.com and tani.ns.cloudflare.com. Google Safe Browsing did not flag the site, and the Gridinsoft trust score was 0/100.

Anyone who interacted with xcoinswap.io should take immediate security precautions. Because the scam type was cryptocurrency-related but no drainer kit was detected, users should review wallet activity for unauthorized transactions and consider moving funds to a new wallet if suspicious activity is found. Users who entered credentials should change passwords, enable two-factor authentication, and monitor for signs of fraud. Suspected phishing domains like xcoinswap.io can be reported to relevant authorities and security organizations to help prevent further incidents.