instaswap[.]live

Analysis shows that instaswap.live is actively hosting a crypto‑related phishing campaign. The domain resolves to IP 199.59.243.228, which is hosted within Amazon's AS16509 network in the United States. Infrastructure details reveal the use of Nginx as the web server and a valid Let's Encrypt TLS certificate, while HTTP requests return a 302 redirect. The domain is delegated to ns1.abovedomains.com and ns2.abovedomains.com and was registered through TRELLIAN‑AU (ASN 133618). Threat intelligence sources corroborate malicious activity: AlienVault OTX lists the domain in 23 pulses, four of ninety‑five VirusTotal scanners flag it, it appears on one security blocklist, and PhishDestroy has already blocked it. Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of abuse. The page title returned is simply "instaswap.live" and no further content analysis is available. Defenders should treat the domain as high‑risk, add it to outbound filtering and DNS blocklists, monitor for any connections to the associated IP range, and ensure that any email or web traffic claiming to originate from the domain is quarantined. Continuous monitoring of the IP owner (Amazon) for changes and periodic re‑scanning of the site are recommended to capture any evolution of the payload or hosting infrastructure.