btc-test[.]cswap[.]trade

The domain btc-test.cswap.trade is currently active and hosted on Amazon infrastructure (AS16509) with the IP address 99.84.152.36 located in Germany. The site resolves to a server that presents the page title "CSWAP | DEX" and serves over HTTPS using an Amazon RSA 2048 M04 certificate. Technological fingerprinting shows a stack that includes Node.js, WebAssembly, React, Next.js, Webpack, and HTTP/3, all delivered via Amazon CloudFront. DNS is managed by four AWS nameservers (ns-1283.awsdns-32.org, ns-712.awsdns-25.net, ns-1958.awsdns-52.co.uk, and an unnamed fourth). The domain was registered on February 21, 2026 through Squarespace Domains II LLC. Threat intelligence flags it as a high‑risk crypto scam; it appears on one security blocklist and is blocked by PhishDestroy. VirusTotal scans reported 5 detections out of 93 vendors, and Gridinsoft assigned a trust score of 0/100. While the specific phishing content has not been publicly disclosed, the combination of a recent registration, low trust score, active blocklisting, and multiple vendor detections indicates malicious intent. Defenders should add btc-test.cswap.trade to deny‑lists, monitor DNS resolutions for the associated IP range, and consider full traffic sink‑holing for any connections to the domain. Further analysis of the loaded page content would be required to confirm the exact phishing vectors, but the present evidence warrants immediate preventive controls.