egonswap[.]org

Analysis of egonswap.org, observed on July 22, 2026, indicates that the domain was created on March 03, 2026 and is currently offline. The site was hosted on Cloudflare infrastructure (AS13335) and resolved to IP 172.67.198.134, a US‑based address. Nameservers cameron.ns.cloudflare.com and keira.ns.cloudflare.com confirm the use of Cloudflare DNS. Registration was performed through NiceNIC International Group Co., Limited, a registrar known to host malicious domains. No TLS certificate was presented, meaning the site operated without HTTPS protection.

The page title “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | EgonSwap” and the declared brand target of Ethereum demonstrate a clear attempt to impersonate the Ethereum brand and lure cryptocurrency users. Detection data show that the domain appears on one security blocklist and is flagged by Google Safe Browsing for social engineering. VirusTotal reported four positive detections out of ninety‑five scanners, further confirming malicious intent. PhishDestroy has also taken the domain offline. The combination of brand impersonation, the crypto‑focused page title, and the classification as a “Crypto Scam” aligns with the observed indicators.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms, as the site content was not captured before takedown. Defenders should therefore block the domain at the network perimeter, add the IP address 172.67.198.134 to deny‑list rules, and monitor for any future subdomains that resolve to the same Cloudflare AS. Continuous observation of NiceNIC‑registered domains and Cloudflare‑hosted IP ranges is recommended, as threat actors frequently recycle this infrastructure. Organizations that allow Ethereum‑related transactions should educate users about unsolicited offers and enforce multi‑factor authentication for wallet access.