nomiswap[.]icu

Analysis of the domain nomiswap.icu indicates it was established as a crypto scam phishing infrastructure, registered on October 5, 2025, through Web Commerce Communications Limited. The domain is currently offline, having been taken down following detection by multiple security mechanisms. Infrastructure analysis reveals the domain resolved to the IP address 198.18.0.32 and utilized Cloudflare nameservers (annalise.ns.cloudflare.com and chris.ns.cloudflare.com). No SSL certificate was present at the time of assessment, which is atypical for legitimate financial platforms and increases the risk of interception or manipulation of user data.

The page title, 'Nomiswap: Innovative Finance Solutions for Secure Transactions,' suggests an attempt to mimic a cryptocurrency exchange or financial service platform, though no specific brand impersonation is confirmed in the available data. Detection by security vendors is notable, with 9 out of 95 engines on VirusTotal flagging the domain as malicious. Additionally, the domain appears on two security blocklists and is referenced in one AlienVault OTX threat intelligence pulse. It is actively blocked by PhishDestroy and ScamSniffer, both of which specialize in identifying phishing and fraudulent financial schemes.

Gridinsoft assigned the domain a trust score of 0/100, further corroborating its classification as high-risk. While the exact content of the phishing page remains unanalyzed, the available evidence—including the scam type designation as a 'Crypto Scam'—aligns with known tactics targeting cryptocurrency users. Defenders should treat this domain as part of a broader phishing campaign and prioritize blocking it at the DNS and network levels. Organizations should also monitor for related infrastructure, such as domains registered through the same registrar or utilizing identical nameservers, as these may indicate additional threats from the same actor.