swapgate[.]my

Analysis indicates that the domain swapgate.my is currently offline but its historical infrastructure reveals a high‑risk crypto‑related brand impersonation campaign targeting the Near brand. The domain was registered on July 29 2025 through Porkbun LLC and uses four Porkbun‑provided nameservers (curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, maceio.ns.porkbun.com, salvador.ns.porkbun.com). DNS resolution points to IP 62.60.226.213, which belongs to AS214351 (FEMO IT SOLUTIONS LIMITED) located in Germany. No TLS certificate was observed, and the site presented the page title “Bitcoin & Crypto Exchange. Fast & Secure Crypto Swap | swapgate.my”, matching the declared crypto‑scam profile.

Reputation checks show a Gridinsoft trust score of 0 / 100, and 17 out of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appears on four public blocklists and is referenced in fifteen AlienVault OTX threat pulses, confirming its presence in multiple intelligence feeds. It is also listed by PhishDestroy, Polkadot, Enkrypt, and Codeesura. The evidence collectively supports a high‑confidence classification of a Near brand impersonation crypto scam.

Uncertainty remains regarding any active command‑and‑control infrastructure because the site is offline, and no post‑exploitation payloads have been publicly released. Defenders should block the domain at perimeter filters, add the associated IP address to deny lists, and monitor for any future DNS changes or reactivation. Continuous threat‑intel correlation with the listed blocklists and OTX pulses is advised to detect potential resurgence. Organizations that interact with Near services should educate users about this impersonation attempt and enforce verification of legitimate Near communication channels.