rialswap[.]com

Analysis of rialswap.com indicates an active cryptocurrency-themed phishing domain registered on February 21, 2026, through 1API GmbH. The domain is currently resolving via Cloudflare infrastructure (AS13335) with nameservers ethan.ns.cloudflare.com and tricia.ns.cloudflare.com, and an IPv6 address of 2a06:98c1:3121::3. The site returns an HTTP 200 status, suggesting operational hosting. Detected technologies include Bootstrap, jQuery, jsDelivr, and Cloudflare Browser Insights, consistent with modern web frameworks used in both legitimate and fraudulent sites. The page title, ریال‌سواپ | RialSwap — صرافی ارز دیجیتال, explicitly presents the domain as a cryptocurrency exchange, aligning with the reported scam type. Security vendors have flagged the domain, with five detections recorded in VirusTotal scans. It appears on at least one security blocklist and has been documented in a threat intelligence pulse on AlienVault OTX. The Gridinsoft trust score of 0/100 further supports its classification as malicious. While the domain's registration age (less than five months) is not inherently suspicious, the combination of cryptocurrency branding, Cloudflare hosting, and confirmed security detections suggests deliberate phishing infrastructure. Defenders should treat this domain as high-risk, particularly in environments where cryptocurrency transactions or user credentials are involved. No evidence currently links this domain to a specific phishing kit or targeted brand beyond its self-declared purpose. Further analysis of the site's content and backend behavior is recommended to determine the exact credential-harvesting or wallet-draining mechanisms in use.