app[.]xn--swelletwork-b7b[.]io

Analysis of the domain app.xn--swelletwork-b7b.io confirms it as an active phishing site targeting Swell Network wallet users. The domain resolves to IP address 103.224.212.101, hosted by Trellian Pty. Limited in Australia, and returns an HTTP 200 status, indicating an operational web server. The page title explicitly displays 'xn--swelletwork-b7b.io,' reinforcing its intent to mimic the legitimate Swell Network platform through punycode-based domain spoofing. Infrastructure evidence includes a Let's Encrypt SSL certificate (YR1), which, while providing HTTPS encryption, does not validate the site's legitimacy. The domain is listed on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and is flagged by 5 of 91 security vendors on VirusTotal. These detections, combined with the punycode deception, strongly indicate malicious intent. The site remains active as of July 19, 2026, with no evidence of takedown or mitigation. Defenders should prioritize blocking this domain at the DNS and network levels, revoking associated SSL certificates, and alerting users to the risk of credential theft or wallet compromise. No additional brand-specific targeting or phishing kit details are currently available, but the domain's structure and blocklist presence align with known cryptocurrency phishing campaigns.