app[.]teleswap[.]xyz

Analysis confirms that the domain app.teleswap.xyz is being used for a brand‑impersonation campaign targeting Ethereum users. The site presents the page title "TeleSwap" and is classified as a cryptocurrency‑related scam, matching the observed brand target. The high‑risk assessment is supported by a Gridinsoft trust score of 0/100 and the presence of the domain on a security blocklist maintained by PhishDestroy.\n\nInfrastructure investigation shows the domain is registered through a widely used DNS provider and resolves to the IP address 3.65.83.35, which is allocated to Amazon.com, Inc. (ASN 16509) and geolocated to Germany. The host serves an SSL certificate issued by Amazon, using a 2048‑bit RSA key. HTTP requests receive a 301 redirect response, indicating that the site may be redirecting visitors to another location. The underlying server stack consists of a Linux‑based operating system and a common web server, supplemented by third‑party analytics and marketing scripts.\n\nThreat intelligence data indicates that 4 out of 95 security vendors on VirusTotal have flagged the domain, reinforcing the suspicion of malicious activity. While the exact content of the landing page has not been captured in this report, the combination of brand impersonation, cryptocurrency scam classification, and low trust scores justifies a high confidence level in the malicious intent of the infrastructure.\n\nDefenders should immediately block app.teleswap.xyz at network perimeters and update endpoint protection rules to include the observed IP address. Continuous monitoring of DNS queries for the associated nameservers (garret.ns.cloudflare.com and sarah.ns.cloudflare.com) is advised to detect any re‑registration attempts. Email security gateways should be tuned to flag messages that reference the "TeleSwap" title or contain links to the domain, and incident response teams should treat any user reports involving this URL as potential credential compromise attempts.