winswaps[.]org

Analysis of winswaps.org indicates a high-risk cryptocurrency phishing domain registered on June 2, 2026, through NameSilo, LLC. The domain is actively flagged by multiple security vendors, including PhishDestroy, MetaMask, and SEAL, and appears on three security blocklists. Google Safe Browsing classifies the site as engaging in social engineering. As of July 29, 2026, the domain resolves to IP address 104.21.65.92, a Cloudflare-hosted endpoint commonly used to obscure origin infrastructure.

VirusTotal reports 15 of 91 security vendors detecting the domain as malicious, though the specific nature of the threat—whether credential harvesting, token theft, or fake wallet interaction—remains unconfirmed due to limited public analysis of the site content. No brand target or phishing kit has been explicitly identified in available intelligence.

Defenders should treat this domain as active and hostile, block it at the DNS or proxy level, and monitor for connections from internal networks. Further investigation into associated wallet addresses, SSL certificates, and HTTP response patterns is recommended to determine the exact attack vector and potential victim impact.