swap-levora-opt[.]com

Analysis of swap-levora-opt.com, observed on July 24, 2026, indicates a high‑risk brand‑impersonation campaign targeting the cryptocurrency brand argent. The domain was registered on 21 February 2026 through Name SRS AB and is hosted on Cloudflare infrastructure (ASN 13335) with the IP address 104.21.20.208 located in the United States. The authoritative nameservers arya.ns.cloudflare.com and ernest.ns.cloudflare.com resolve the domain to the same IP, and no TLS certificate was presented, meaning the site operated without HTTPS protection. Public threat‑intel sources cite the domain in a single AlienVault OTX pulse and note its inclusion on three independent security blocklists.

Additionally, the domain is actively blocked by the PhishDestroy, MetaMask, and SEAL filtering services. VirusTotal scans returned ten positive detections out of ninety‑three AV engines, and Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The page title retrieved from the site – “Swap Levora Opt - Plateforme officielle | Trading IA 2025 | Plus de 10 000 avis” – aligns with the declared crypto‑scam narrative and the brand‑impersonation objective. Current activity logs show the site is offline, but the infrastructure remains reachable and could be reused for future campaigns.

Defenders should continue to block the domain and its associated IP address at network perimeters, update endpoint and DNS filtering policies, and monitor for new registrations that mimic the “swap‑levora‑opt” naming pattern. Because the domain lacks a valid SSL certificate, any future re‑appearance would be observable via HTTP‑only traffic, simplifying detection. Ongoing surveillance of the registrar Name SRS AB and the Cloudflare edge network may reveal additional related domains.