chain-swap[.]com

Analysis of the domain chain-swap.com indicates it is an active phishing site targeting cryptocurrency users as of July 12, 2026. The domain was registered on May 16, 2026, through NameCheap, Inc., and currently resolves to the IP address 104.21.6.75, which is hosted by Cloudflare, Inc. in Canada. Infrastructure analysis reveals the use of Cloudflare nameservers (georgia.ns.cloudflare.com and wesley.ns.cloudflare.com) and a Let's Encrypt SSL certificate (serial number E7), suggesting an attempt to appear legitimate while obscuring the true hosting origin. The domain is flagged by multiple security blocklists, including PhishDestroy, MetaMask, and SEAL, and appears in one threat intelligence pulse on AlienVault OTX. Despite these indicators, the domain was scanned by 92 vendors on VirusTotal with no current detections, though the absence of detections does not confirm safety. The page title 'Just a moment...' is consistent with Cloudflare interstitial pages, which may be used to filter or redirect visitors. Gridinsoft assigns the domain a trust score of 0/100, further supporting its classification as high-risk. At present, the exact nature of the phishing content remains unconfirmed, as the site's payload has not been fully analyzed. However, the combination of cryptocurrency-related naming, active blocklist presence, and Cloudflare-based infrastructure aligns with known phishing tactics in this sector. Defenders are advised to treat this domain as malicious and implement blocking measures at the DNS or network level. Further monitoring is recommended to assess any changes in behavior or additional detections.