timeswap[.]org

Analysis of timeswap.org shows a high‑risk, active brand‑impersonation campaign targeting Revolut. The domain was registered on October 08, 2025 through GoDaddy.com, LLC and is hosted on IP 216.24.57.1, which resolves via AS397273 (Render) in the United States. HTTP requests return a 200 status code and the site is fronted by Cloudflare with HTTP/3 support, presenting a Google Trust Services / WE1 SSL certificate. The domain appears on a single security blocklist and has been flagged by PhishDestroy, confirming its malicious status. Reputation scoring from Gridinsoft is 0 out of 100, indicating a completely untrusted profile. VirusTotal scans report five detections out of ninety‑five vendors, reinforcing the suspicion of malicious activity. Nameservers are ns01.domaincontrol.com and ns02.domaincontrol.com, both typical of GoDaddy‑registered domains. The campaign is classified as a crypto scam, though the specific payload or phishing page content has not been publicly disclosed. Defenders should immediately block timeswap.org at perimeter controls and update URL filtering rules. Continuous monitoring of DNS queries for the resolved IP and associated nameservers is advised, as well as inclusion of the domain in threat‑intel feeds. Given the low trust score and multi‑vendor detections, the domain should be treated as hostile until a thorough content analysis confirms otherwise.