fxswap[.]app

The domain fxswap.app was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently taken offline. DNS resolution points to the IP address 104.21.30.168, which belongs to Cloudflare, Inc. (AS13335) and is located in the United States. The domain uses Cloudflare nameservers kay.ns.cloudflare.com and trey.ns.cloudflare.com, but no SSL certificate is presented, indicating that HTTPS connections are not supported. An HTTP request to the site returns a 404 Not Found page title, confirming that no legitimate landing page is available at the time of analysis. Security telemetry shows that fxswap.app appears on three independent blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, suggesting that multiple anti‑phishing solutions have identified the domain as malicious.

VirusTotal scans report that five out of ninety‑three security vendors flag the domain, providing additional confirmation of its suspicious nature. The Gridinsoft trust score is recorded as 0 out of 100, reinforcing the assessment of a low‑trust site. AlienVault OTX lists the domain in a single threat‑intel pulse, indicating that it has been observed in at least one broader threat campaign. The listed scam type is a crypto scam, which aligns with the domain’s naming pattern and the involvement of MetaMask in its blocklist status. However, no specific cryptocurrency platform or brand is named in the available evidence, and the exact phishing payload or luring technique remains unknown because the site returns a 404 response and no page content has been captured.

Defenders should continue to block traffic to fxswap.app at network perimeters and update endpoint protection signatures to reflect its presence on known blocklists. Monitoring for DNS queries to the associated Cloudflare IP address can help detect residual or resurrected activity.