swap-coin[.]fun

Analysis of swap-coin.fun, taken offline as of the report date 24 July 2026, shows an infrastructure deliberately crafted to impersonate the Avalanche brand in a crypto‑scam context. The domain was registered on 28 December 2025 through Beget LLC, a Russian‑based registrar that also provides the authoritative name servers ns1.beget.com, ns1.beget.pro, ns2.beget.com and ns2.beget.pro. DNS resolution points to IP address 45.130.41.125, which belongs to AS198610 owned by Beget LLC and is geolocated in Russia. No TLS certificate is presented, indicating the site operated over plain HTTP.

The sole visible artifact is the page title "Обменный пункт электронных валют," a Russian phrase meaning “electronic currency exchange point,” which aligns with the declared crypto‑scam classification. Security‑industry tooling has flagged the domain on four blocklists, and it has been actively blocked by PhishDestroy, Polkadot, Enkrypt and Codeesura. Gridinsoft assigns a trust score of 0 / 100, reflecting a complete lack of credibility. VirusTotal analysis records two detections out of ninety‑three scanners, confirming that at least a minority of AV engines recognize malicious behavior.

The elevated risk rating derives from the combination of brand impersonation, lack of encryption, and confirmed detections. Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as no additional page content has been disclosed. Defenders should continue to enforce network‑level denial of 45.130.41.125, ensure the domain remains on blocklists, and monitor Beget’s name‑server zones for re‑registration attempts. Regular re‑scans with multi‑engine services are advised to capture any evolution of the payload, and incident response teams should treat any traffic to this host as hostile, given the confirmed brand‑spoofing intent.