fireswap[.]us

The domain fireswap.us was registered on 21 February 2026 and resolves to the IPv4 address 199.188.201.89, which is hosted by Namecheap, Inc. (AS22612) in the United States. The site presented the page title “Fire Swap” and is classified as a crypto‑scam that directly impersonates the decentralized exchange platform 1inch. TLS negotiation uses a Sectigo Public Server Authentication CA DV R36 certificate, indicating a standard domain‑validated certificate without extended validation.

Automated scanning on VirusTotal recorded a single positive detection out of 95 participating vendors, and the domain appears on one public blocklist. The threat‑intelligence feed PhishDestroy has already taken the domain offline, and the current status is reported as “taken offline.” Independent reputation scoring from Gridinsoft assigns a trust score of 0 / 100, reflecting a high confidence of malicious intent. No additional public analyses or content captures are available, so the exact malicious payload or credential‑harvesting mechanisms remain unconfirmed.

The observable infrastructure—US‑based Namecheap hosting, a recent registration date, a low‑trust SSL certificate, and a single vendor flag—aligns with typical brand‑impersonation campaigns targeting cryptocurrency users. Defenders should immediately add fireswap.us to URL filtering and DNS blocklists, monitor the associated IP address for any future re‑hosting activity, and consider extending blocklist coverage to the underlying Namecheap AS22612 network. Continuous re‑evaluation is advised in case additional detections emerge from other scanning services.