app[.]blockswap[.]live

Analysis of app.blockswap.live confirms its classification as a wallet seed phishing site targeting users of the Across protocol. The domain, registered through Dynadot Inc, resolved to IP 176.123.0.199, hosted on AS200019 (ALEXHOST SRL) in Moldova. Nameservers ns1.dyna-ns.net and ns2.dyna-ns.net were in use, and no SSL certificate was present at the time of assessment. The page title, 'Best Crypto Wallet for Web3, NFTs and DeFi | Trust,' aligns with tactics commonly employed to deceive users into disclosing wallet credentials or seed phrases. Detection data from July 24, 2026, shows 10 of 95 security vendors on VirusTotal flagged the domain as malicious.

The domain also appears on one security blocklist and is actively blocked by PhishDestroy. Scamadviser assigned a trust score of 1 out of 100, further corroborating its fraudulent nature. The site is currently offline, though defenders should treat it as a confirmed threat due to its prior resolution and detection history. Infrastructure analysis reveals the use of a Moldovan hosting provider with a history of abuse reports, though no direct attribution to a specific threat actor or campaign is available.

The absence of an SSL certificate is notable, as it may have triggered browser warnings, potentially limiting the campaign's effectiveness. Defenders should prioritize blocking the domain, its resolving IP, and associated nameservers in perimeter security controls. Monitoring for newly registered domains with similar naming patterns (e.g., 'blockswap' or 'across' variants) and hosting on AS200019 is recommended. Given the elevated risk level, organizations handling cryptocurrency transactions or Across protocol integrations should alert users to this specific threat and verify any prior interactions with the domain.