bulwarswap[.]com

The domain www.bulwarswap.com was registered on February 21, 2026 and is currently taken offline. DNS resolution points to the IP address 172.67.186.219, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presented a TLS certificate labeled WE1, indicating the use of a publicly‑available certificate rather than a brand‑specific one. Security telemetry shows the domain appears on one blocklist and is listed by PhishDestroy as a malicious host.

Gridinsoft assigned a trust score of 0 / 100, reflecting an extremely low confidence rating. VirusTotal analysis recorded nine positive detections out of ninety‑three scanners, confirming that multiple security vendors consider the host malicious. The page title returned by the web server—"Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | BulwarSwap"—coupled with the declared scam type of "Crypto Scam" suggests the infrastructure was designed to lure victims into a cryptocurrency‑related transaction flow. The domain explicitly impersonates the Ethereum brand, aligning with the observed brand‑target field.

While the site is no longer reachable, the underlying Cloudflare IP may be reused for other fraudulent campaigns, and the TLS certificate identifier (WE1) could be indicative of a reusable kit. Defenders should continue to block 172.67.186.219 at network perimeters, add www.bulwarswap.com to URL filtering and threat‑intel feeds, and monitor for any re‑registration of the domain or reuse of the same IP range in future phishing attempts. Ongoing correlation with other indicators of compromise, such as the WE1 certificate fingerprint, may reveal additional malicious actors leveraging the same infrastructure.