no-kyc-swap[.]xyz

Analysis of no-kyc-swap.xyz indicates that the domain was created on 21 February 2026 and is hosted behind Cloudflare’s network (AS13335) with the IP address 172.67.188.27 located in the United States. The domain resolves to a server presenting a Google Trust Services / WE1 SSL certificate, confirming the use of legitimate TLS infrastructure but not implying benign intent. The page title returned by the site, “LOKJA - Lëvizje Kulturore nga Suhareka,” does not correspond to any known legitimate service and is consistent with a deceptive landing page used in the reported crypto‑scam campaign. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy feed. VirusTotal records show that six of ninety‑three scanned scanners flagged the domain, reinforcing the suspicion of malicious activity.

The registrar listed as NiceNIC International Group Co., Limited is a known bulk registration service, and the nameservers anuj.ns.cloudflare.com and sandra.ns.cloudflare.com are standard Cloudflare hostnames, offering no additional attribution. Gridinsoft assigned a trust score of 0 out of 100, indicating a high confidence of malicious classification. The observed technology stack includes Cloudflare and HTTP/3, which are commonly leveraged to hide malicious traffic behind reputable infrastructure. The current status is offline, suggesting that the phishing or crypto‑draining campaign has been taken down or the site is no longer serving content.

Defenders should continue to block DNS resolution to 172.67.188.27 and add no-kyc-swap.xyz to local deny lists. Monitoring for any re‑registration or resurrection of the domain, as well as for similar domains registered by the same registrar or using the same nameservers, is recommended. Correlation with other indicators of compromise, such as the six VirusTotal detections, can aid in attributing related activity.