bridge-liquiditynetwork-swap[.]cc

Analysis of bridge-liquiditynetwork-swap.cc as of July 24 2026 indicates that the domain is being used for a crypto‑related brand‑impersonation campaign targeting Celer. The domain was registered on 8 September 2025 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (ASN 13335) with the IP address 172.67.209.85 located in the United States. No TLS certificate is presented, and an HTTP request returns the generic page title “Website Created,” suggesting a placeholder site rather than a functional service. VirusTotal records show that seven of ninety‑five scanning engines flag the domain, and the Gridinsoft trust score is 0 / 100, both indicating a high likelihood of malicious intent.

The domain appears on a single security blocklist and has been specifically blocked by the PhishDestroy service. The nameservers elliott.ns.cloudflare.com and lara.ns.cloudflare.com confirm the use of Cloudflare DNS. The observed characteristics – a recent registration, lack of encryption, low trust rating, and vendor detections – align with the classification of a crypto scam that impersonates the Celer brand.

Uncertainty remains regarding the exact content served to victims because the site is currently offline and no screenshots or payload details have been captured. Defenders should continue to block the domain at perimeter and DNS filters, monitor for any future re‑hosting attempts, and consider adding the associated IP address to threat‑intel feeds. Additional telemetry, such as HTTP request logs or malware samples, would be required to fully assess the payload and potential impact on compromised credentials or funds.