oxswap[.]org[.]tr

Analysis indicates that the domain oxswap.org.tr was registered on February 21, 2026 and currently resolves to the IP address 5.182.210.39, which is hosted in the Netherlands under Autonomous System AS62068 (SpectraIP B.V.). The site presents a TLS certificate issued by ZeroSSL RSA Domain Secure Site CA, confirming that HTTPS is available despite the domain’s offline status. Metadata collected from public intelligence sources classifies the domain as a crypto scam, with the page title returned as "OxSwap.org". Trust scoring services have assigned the lowest possible ratings: Scamadviser reports a score of 1 out of 100, and Gridinsoft records a score of 0 out of 100, reinforcing the assessment of malicious intent.

The domain appears on four independent security blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—demonstrating consensus among threat‑intelligence providers that the host is malicious. VirusTotal analysis shows that two of ninety‑three scanning engines flagged the domain, providing additional technical corroboration of its risk profile. The site is presently offline, limiting immediate interaction but not eliminating the possibility of re‑activation.

Uncertainties remain regarding the specific phishing mechanisms employed, the presence of malicious payloads, and the extent of victim outreach, as no content snapshots or kit identifiers are available. Defenders are advised to block the domain and its associated IP address at network perimeters, incorporate the host into internal threat‑intel feeds, and monitor DNS query logs for any attempts to resolve the domain. Continuous observation of the host’s activity and periodic rescanning are recommended to detect any future re‑deployment.