swap[.]steamexchange[.]io

The domain swap.steamexchange.io is a phishing site that engages in brand impersonation, specifically targeting the MEXC brand. The site is currently taken offline, but it previously posed an elevated risk to users as a wallet_connect_phish scam. When active, the page title was 'Rails Network Swap | Rails Network® Swap', which could mislead users into thinking they were interacting with a legitimate service.

swap.steamexchange.io was registered through GoDaddy.com, LLC on February 14, 2022, and resolves to the IP address 172.67.172.139, located in the US under AS13335 Cloudflare, Inc. The domain has been flagged by 1 of 95 VirusTotal vendors, including SOCRadar, and appears on 3 security blocklists: PhishDestroy, MetaMask, and SEAL. Despite these detections, Google Safe Browsing has not flagged the domain. The site uses technologies such as React, Netlify, HSTS, Google Analytics, Cloudflare Browser Insights, Cloudflare, and HTTP/3. The nameservers for the domain are jaziel.ns.cloudflare.com and keira.ns.cloudflare.com.

If a user has interacted with swap.steamexchange.io, they should immediately revoke any token approvals and move their funds to a new, secure wallet to mitigate the risk of a crypto drainer. For those who may have entered login credentials, it is crucial to change passwords and enable two-factor authentication on all affected accounts. Users should also monitor their accounts for any signs of unauthorized activity or fraud. To report this phishing domain, individuals can submit it to PhishTank, Google Safe Browsing, and other reputable reporting platforms.