api-v4-swap[.]cc

Analysis of api-v4-swap.cc indicates a confirmed phishing domain targeting cryptocurrency users, currently offline as of July 23, 2026. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolves to Cloudflare IP 104.21.5.209 (AS13335, US). Infrastructure review shows Cloudflare nameservers (lennon.ns.cloudflare.com, paris.ns.cloudflare.com) and a Google Trust Services SSL certificate (WE1), consistent with many phishing campaigns leveraging Cloudflare for hosting and proxy services. At the time of assessment, the domain returned an HTTP 403 status with a Cloudflare interstitial page titled 'Suspected phishing site,' a common mitigation response for flagged domains.

Security vendor detections on VirusTotal reached 16 of 93 engines, a moderate but not conclusive signal given the absence of contextual details about detection methods or payloads. The domain appears on one security blocklist, and Gridinsoft assigned a trust score of 0/100, reinforcing its classification as malicious. The scam type is explicitly labeled as a crypto scam, though no specific brand or platform impersonation is confirmed in available metadata. No evidence links the domain to a known phishing kit or campaign cluster.

Defenders should treat api-v4-swap.cc as a confirmed threat vector for cryptocurrency fraud. Recommended actions include blocking the domain at DNS and proxy layers, monitoring for related subdomains or IP reuse, and alerting users to the crypto scam classification. The domain's Cloudflare hosting and recent registration suggest potential for rapid redeployment; continuous monitoring of associated infrastructure is advised. No active payloads or redirects were observed, but prior malicious activity is strongly indicated by detection data and blocklist inclusion.