kybercwan[.]xyz

Analysis of kybercwan.xyz indicates that the domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is currently hosted behind Cloudflare's network (AS13335) with the IP address 188.114.97.3 located in the United States. The authoritative nameservers mack.ns.cloudflare.com and zara.ns.cloudflare.com resolve to Cloudflare's edge infrastructure, and the site served content over HTTP/3 using a TLS certificate issued by Google Trust Services under the WE1 root. The page title observed when the site was live reads “KyberSwap – Limitless Access To DeFi,” aligning with the declared scam type of a crypto‑related phishing operation.

VirusTotal scans show that nine out of ninety‑three security vendors flagged the domain, and the domain appears on three independent blocklists, including PhishDestroy, MetaMask, and SEAL, reinforcing the malicious classification. The domain is presently taken offline, and no further HTTP response data is available, leaving the current content unknown. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑hosting attempts that reuse the same IP or certificate, and add the observed indicator set (IP 188.114.97.3, Cloudflare nameservers, page title, and SSL issuer) to threat intel feeds.

Because the site is already listed on multiple blocklists, existing security solutions that ingest these feeds will likely already be enforcing protection, but manual rule addition can reduce latency. Ongoing observation of the registrar NiceNIC and the Cloudflare hosting account may reveal future re‑registration attempts. Until the site reappears, the primary mitigation is to maintain the current blocklist entries and ensure endpoint browsers respect the blocked status.