bitcoinexchangemonero[.]com

Analysis of bitcoinexchangemonero.com shows an active infrastructure that mimics the Bitcoin brand to promote a fraudulent exchange service. The domain was registered on July 02, 2025 through Gransy, s.r.o. and is hosted behind Cloudflare (IP 104.21.89.197, located in Canada). The site returns HTTP 200 and presents a page title that advertises a “Premier Bitcoin to Monero Exchange” with “Anonymous BTC↔XMR Swaps in 2‑5 Minutes.” The page leverages Cloudflare Browser Insights and HTTP/3, and it presents a Google Trust Services / WE1 SSL certificate. Reputation data is uniformly negative: Gridinsoft assigns a trust score of 0/100, three of ninety‑one VirusTotal scanners flag the domain, and it appears in a single AlienVault OTX pulse and one external blocklist. PhishDestroy has already blocked the domain, but the site remains reachable. The primary threat is brand impersonation used to lure cryptocurrency users into a fake exchange, potentially harvesting credentials or funds. Uncertainty remains about the exact payload delivered after a victim initiates a transaction, as the page content beyond the title has not been publicly disclosed. Defenders should block the domain at network perimeter, monitor DNS queries for the associated Cloudflare nameservers, and add the IP address to threat‑intel feeds. Automated URL filtering should treat any request to this domain as malicious, and incident responders should advise users to avoid any unsolicited offers to swap Bitcoin for Monero that reference this URL.