calvinswaps[.]com

Analysis of calvinswaps.com confirms its classification as a high-risk crypto scam domain, currently offline as of July 23, 2026. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with fraudulent infrastructure. It resolves to the IP address 130.12.182.192, hosted on AS36680 (Netiface LLC) in Germany, a network segment previously observed in cryptocurrency-related fraud campaigns. Cloudflare nameservers (cash.ns.cloudflare.com and nola.ns.cloudflare.com) are configured, a common tactic to obscure hosting origins and evade takedowns. Security vendor detections are substantial but not exhaustive: 15 of 95 engines on VirusTotal flagged the domain as malicious, and it appears on three security blocklists.

Google Safe Browsing explicitly categorizes it as social engineering, aligning with its designation as a crypto scam. The domain lacks an SSL certificate, a red flag for phishing sites attempting to avoid encryption overhead or certificate transparency logs. Gridinsoft assigns a trust score of 0/100, further corroborating its fraudulent nature. No specific brand impersonation or phishing kit details are available from the provided data, though the scam type is confirmed as cryptocurrency-related.

Defenders should treat this domain as compromised and prioritize blocking it at DNS, proxy, and endpoint layers. The absence of an active SSL certificate and the use of Cloudflare nameservers suggest evasion tactics, so monitoring for re-registration or IP shifts is recommended. Given its offline status, historical logs should be reviewed for connections from internal assets to 130.12.182.192 or related domains. No further content analysis is available; defenders should rely on the existing detection signals and infrastructure indicators for mitigation.