mindswap[.]cc

This domain is flagged for elevated-risk brand impersonation targeting Binance users. The threat involves a fraudulent cryptocurrency swap interface designed to deceive victims into entering account credentials or transferring digital assets to attacker-controlled wallets. Analysis indicates the domain specifically mimics Binance’s trading infrastructure, presenting itself as a legitimate instant swap service under the page title 'MindSwap - Instant Crypto Swaps.' Infrastructure analysis reveals the following technical indicators: the domain was registered on February 21, 2026, through Cloud DNS Ltd, an uncommon registrar for cryptocurrency services. It resolves to IP address 138.226.237.72, hosted on AS205775 (NEON CORE NETWORK LLC) in Germany. The domain is flagged by 11 out of 95 security vendors on VirusTotal and appears on one security blocklist. It was previously blocked by PhishDestroy. The SSL certificate is issued by Let's Encrypt (serial number E7), which, while providing encryption, does not validate the legitimacy of the site. The domain’s creation date is suspiciously recent for a purported financial service, and its hosting provider has been associated with other malicious activities. Mitigation steps for this specific threat type include immediate verification of domain authenticity before entering credentials or initiating transactions. Users should cross-reference URLs with official Binance domains and enable multi-factor authentication (MFA) on all cryptocurrency accounts. Organizations should update security blocklists to include mindswap.cc and its associated IP address (138.226.237.72). Network-level monitoring for connections to this IP or domain can help detect compromised endpoints. Cryptocurrency users are advised to verify swap services through official Binance channels and report suspicious domains to relevant abuse contacts, including the hosting provider (AS205775) and registrar (Cloud DNS Ltd).