swapua[.]com

Analysis of swapua.com indicates a high-risk cryptocurrency scam domain actively targeting users as of July 12, 2026. The domain, registered on February 21, 2026, through NiceNIC International Group Co., Limited, presents itself as a cryptocurrency exchange platform, as evidenced by its page title: 'Cryptocurrency Exchange Platform: Crypto Coin Exchange By Swapuz | Swapuz.' This aligns with the classified scam type of 'Crypto Scam,' though the exact mechanics of the fraudulent operation remain unconfirmed due to limited on-page analysis. Infrastructure analysis reveals the domain is hosted behind Cloudflare (AS13335), resolving to IP address 172.67.223.136, located in the United States. The use of Cloudflare nameservers (jewel.ns.cloudflare.com, leo.ns.cloudflare.com) and Cloudflare Browser Insights suggests an attempt to obscure backend infrastructure and evade detection. Detected technologies include Node.js, Vue.js, Express, and Highcharts, which are consistent with modern web applications but do not inherently indicate malicious intent. The domain employs an SSL certificate issued by Google Trust Services (WE1), providing a superficial layer of legitimacy. Security vendor assessments show six of 93 engines flagging the domain as malicious on VirusTotal, while PhishDestroy has explicitly blocked it. The domain also appears on at least one security blocklist. Gridinsoft assigns a trust score of 0/100, further corroborating its high-risk status. Despite these indicators, the domain remains accessible, returning an HTTP 200 status code. Defenders should prioritize blocking this domain at the network level, particularly in environments where cryptocurrency-related activity is prohibited or monitored. Given the domain's recent registration and active status, continuous monitoring for related infrastructure (e.g., subdomains, associated IPs) is recommended.