wenjuan[.]themisswap[.]org

The domain wenjuan.themisswap.org was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. The site presented the page title “卷王问卷考试系统” and operated without an SSL certificate, indicating that traffic was unencrypted. DNS resolution points to the Cloudflare address 104.21.19.180, which is associated with ASN 13335, a Cloudflare network located in the United States. The domain appeared on three known security blocklists and received a Gridinsoft trust score of zero out of one hundred, reflecting a highly malicious reputation.

Malware scanning on VirusTotal recorded a single positive detection out of ninety‑three vendors, reinforcing the suspicion of malicious activity. The infrastructure was flagged by PhishDestroy, MetaMask, and SEAL, and the domain is currently listed as offline. Classification from the intelligence set identifies the activity as a crypto‑related scam, though the exact mechanism of the fraud is not disclosed. The lack of HTTPS, low trust score, presence on multiple blocklists, and the positive vendor detection collectively substantiate the classification.

While the page content has not been captured, defenders should continue to block the domain at network perimeters, update URL filtering rules, and monitor for any re‑appearance of the host or related subdomains. Additional scrutiny of recent registrations from the same registrar may reveal a broader campaign. The evidence presented, including registration details, hosting attribution, blocklist listings, and vendor detection, provides a concrete basis for remediation and further investigation.