cryptoswapnokyc[.]com

The domain cryptoswapnokyc.com was registered through GoDaddy.com, LLC on 11 March 2025. Its DNS records point to the Cloudflare nameservers craig.ns.cloudflare.com and laura.ns.cloudflare.com, resolving to the IP address 172.67.192.252, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presented an SSL certificate issued by Google Trust Services under the WE1 identifier, indicating a valid HTTPS configuration despite the malicious purpose. The page title advertised a "No KYC Exchange | Swap Crypto without KYC," which aligns with the listed scam type of a crypto scam. The underlying platform was identified as WordPress running MySQL and PHP, with additional components including Yoast SEO, jsDelivr, jQuery CDN, jQuery, and the Cloudflare front‑end.

The infrastructure was flagged by at least one security vendor on VirusTotal, with 1 of 95 scanners reporting a detection, and the domain appears on a single security blocklist. PhishDestroy has also blocked the domain. The Gridinsoft trust score of 0/100 reflects a highly suspicious rating. The domain explicitly impersonates Binance, targeting users of the well‑known exchange.

As of the report date (24 July 2026) the site is offline, limiting immediate observation of its content. However, the combination of a recent registration, Cloudflare hosting, a valid SSL certificate, and a low trust score suggests a typical fast‑flux style crypto‑scam deployment. Defenders should add the domain to internal blocklists, monitor for any re‑appearance of the same IP or nameserver configuration, and watch for similar WordPress‑based phishing kits that reference Binance. Additional vigilance is recommended for traffic to Cloudflare‑hosted IPs that resolve to newly created domains with low trust scores and crypto‑related page titles, as these indicators have proven useful in early detection of related campaigns.