retoswap[.]com

The domain retoswap.com was registered on February 21, 2026 through NameCheap, Inc. and currently resolves to the IPv6 address 2606:50c0:8001::153, which belongs to the Fastly network in the United States (AS54113). The authoritative nameservers are agustin.ns.cloudflare.com and magali.ns.cloudflare.com, indicating that the domain is fronted by a Cloudflare service. An HTTP GET returns status code 200 and the page title "Buy & Sell Monero | Cash. Crypto. P2P.", matching the declared scam type of a crypto scam. The site presents TLS certificates from Let’s Encrypt (R13) and enforces HSTS, while backend components include Varnish, Fastly, and GitHub Pages. Email routing uses Proton Mail MX records (mail.protonmail.ch, priority 10, and a secondary host at priority 20). Reputation signals show the domain on the PhishDestroy blocklist, flagged by three of ninety-three VirusTotal scanners, and cited in a single AlienVault OTX pulse. Gridinsoft assigns a trust score of 4 out of 100, reinforcing the high‑risk assessment. The available evidence points to an active, high‑severity phishing operation targeting cryptocurrency users. Defenders should immediately block retoswap.com at perimeter and DNS layers, monitor for related hash or IP indicators, and consider adding the domain to internal threat‑intel feeds. Ongoing observation is advised to capture any evolution of the payload or additional infrastructure.