bisoswap[.]io

On July 23, 2026, analysis of the domain bisoswap.io was performed. The site is currently taken offline, but historical evidence indicates it was used for a brand‑impersonation campaign targeting the Ethereum ecosystem. The page title observed during the brief live period – “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | BisoSwap” – suggests the operator attempted to present a cryptocurrency exchange service, directly referencing Ethereum to lure victims. The domain was registered on October 25, 2025 through NiceNIC International Group Co., Limited, a registrar known to host malicious infrastructure. Trust‑score services consistently rate the domain poorly: Gridinsoft assigns a score of 1 out of 100 and Scamadviser also reports 1 out of 100, indicating extreme suspicion.

VirusTotal scans show that eight of ninety‑five security vendors flagged the domain, reinforcing the malicious classification. The domain resolves to IP address 188.114.96.3, which belongs to AS13335 owned by Cloudflare, Inc., and the resolution is performed via the Cloudflare nameservers pat.ns.cloudflare.com and trace.ns.cloudflare.com. The hosting location is listed as the United States. SSL was provided by Google Trust Services under the WE1 certificate, a common issuance for Cloudflare‑protected sites, and the site supported HTTP/3. Technology fingerprints include Node.js, Chart.js, Vue.js, Nuxt.js, Facebook Pixel, and cdnjs, consistent with a modern web application stack.

The domain appears on a single security blocklist and has been actively blocked by PhishDestroy. The evidence points to a crypto‑scam infrastructure that leverages reputable CDN services to conceal its true origin while presenting a counterfeit exchange front‑end. Uncertainty remains regarding the extent of user data harvested, the presence of additional command‑and‑control hosts, and whether the infrastructure is part of a larger campaign.