retoswap[.]net

The domain retoswap.net was registered on 21 February 2026 through NameCheap, Inc. and currently resolves to 185.199.111.153, an address owned by Fastly (AS54113) located in the United States. DNS resolution is delegated to matteo.ns.cloudflare.com and sarah.ns.cloudflare.com, indicating the use of Cloudflare’s authoritative name servers. The site presents a page titled “Buy & Sell Monero | Cash. Crypto. P2P.” and is classified as a crypto‑scam. Infrastructure analysis shows the presence of Fastly’s edge service, Varnish caching, and HSTS enforcement, while the front‑end appears to be hosted on GitHub Pages. TLS is provided by Google Trust Services under the WE1 certificate, suggesting a legitimate certificate chain despite the malicious intent. Proton Mail is detected among the technologies, possibly used for disposable communications. An HTTP 301 redirect is observed, and the domain has been flagged by PhishDestroy and listed on one security blocklist. VirusTotal records indicate that one of ninety‑three scanners raised a detection. The Gridinsoft trust score of zero further underscores its malicious nature. Although the exact content of the landing page has not been examined, the combination of a recent registration, fastly‑based hosting, and a cryptocurrency‑focused title aligns with known patterns of crypto‑related phishing campaigns. Defenders should block retoswap.net at perimeter filters, monitor DNS queries for the associated Cloudflare name servers, and consider adding the IP address to threat‑intel feeds. Ongoing surveillance is advised to detect any pivot to additional infrastructure or credential‑harvesting services.