houdiniswapx[.]org

On 25 July 2026 the domain houdiniswapx.org was observed as an inactive crypto‑focused phishing site. The registration record shows the domain was created on 21 April 2025 through Web Commerce Communications Limited and is served by Cloudflare nameservers elsa.ns.cloudflare.com and sam.ns.cloudflare.com. DNS resolution points to IP address 104.21.80.1, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. The site presented the page title “HoudiniSwap: Private Crypto & Cross‑Chain Swaps”, indicating an attempt to masquerade as a private cryptocurrency swapping service. No TLS certificate was detected, suggesting the site was reachable only over plain HTTP or that the certificate was omitted in the scan.

VirusTotal analysis recorded nine positive detections out of ninety‑five security vendors, and the domain appears on a single external blocklist. PhishDestroy has listed the domain as blocked, and the current operational status is offline. The available evidence confirms that the infrastructure was deliberately placed behind Cloudflare to obscure the true origin of the hosting server while leveraging a reputable registrar. The modest detection count and single blocklist entry imply limited exposure, yet the use of a convincing brand‑like name and the crypto‑swap narrative are typical of credential‑stealing campaigns targeting cryptocurrency users.

Because the site is no longer active, immediate threat to end‑users is reduced, but the underlying registration and hosting patterns remain reusable for future campaigns. Defenders should add houdiniswapx.org to local DNS and URL filtering rules, monitor the associated Cloudflare IP range for similar activity, and consider sharing the detection fingerprints with intelligence platforms to improve collective coverage. Continuous observation of new domains registered by the same registrar and nameserver pair may reveal repeat offenders.