retoswap[.]app

Analysis of retoswap.app indicates a high-risk cryptocurrency phishing domain, active as of July 12, 2026. The domain was registered on February 21, 2026, through NameCheap, Inc., and currently resolves to IP 185.199.109.153, hosted on AS54113 (Fastly, Inc.) in the United States. The page title, "Buy & Sell Monero | Cash. Crypto. P2P," suggests a focus on Monero transactions, aligning with the reported scam type of cryptocurrency fraud. Infrastructure analysis reveals the use of Cloudflare nameservers (matteo.ns.cloudflare.com, sarah.ns.cloudflare.com), HSTS, and a 301 HTTP redirect, which may be employed to obscure backend hosting or evade detection. Technologies detected include Proton Mail, Varnish, GitHub Pages, and Fastly, which are consistent with legitimate services but are also commonly abused in phishing operations. The SSL certificate is issued by Google Trust Services (WE1), a valid but non-exclusive indicator of legitimacy. Security vendor detections remain limited, with only 2 of 93 vendors flagging the domain on VirusTotal, and it appears on a single security blocklist. The domain is currently blocked by PhishDestroy, though it remains operational. Defenders should treat this domain as actively malicious, particularly in environments handling cryptocurrency transactions. The use of Cloudflare and Fastly infrastructure may complicate takedown efforts, and the domain’s recent registration (less than five months old) aligns with patterns observed in short-lived phishing campaigns. No specific brand impersonation is confirmed beyond the Monero-related page title, and the exact content or functionality of the site has not been analyzed. Network-level blocking or monitoring for connections to 185.199.109.153 is recommended until further analysis or takedown occurs.