transitswap[.]online

Analysis of transitswap.online identifies it as a crypto scam domain registered on June 12, 2025, through Gname.com Pte. Ltd. The domain currently resolves to 172.67.198.70, an IP address assigned to Cloudflare, Inc. (AS13335) in the United States. Infrastructure review shows the domain uses Cloudflare nameservers (augustus.ns.cloudflare.com and coraline.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns. No SSL certificate is present, increasing the risk of unencrypted credential interception. As of July 24, 2026, the domain is offline, though its prior operational status suggests it may have been active for malicious purposes.

Security vendor detections on VirusTotal indicate 14 of 95 engines flagged the domain, though the specific nature of these detections—whether related to phishing, malware distribution, or other threats—remains unconfirmed. The domain appears on one security blocklist, PhishDestroy, reinforcing its classification as a phishing threat. The absence of additional blocklist entries or public threat intelligence reports limits broader context on its campaign scope or victim targeting. Defenders should treat transitswap.online as a confirmed malicious domain, particularly given its crypto scam classification.

The use of Cloudflare infrastructure and lack of SSL further suggest efforts to avoid detection. While the domain is currently offline, organizations should monitor for re-activation or related infrastructure, such as newly registered domains with similar naming patterns or shared hosting IPs. If historical DNS or traffic logs exist, retroactive analysis may reveal compromised accounts or additional indicators of compromise. No brand impersonation details or page content analysis are available at this time.