cow[.]swap-main[.]net

The domain cow.swap-main.net was registered on 21 February 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently listed as offline. The authoritative nameservers point to expired-ns1.niceisp.com and expired-ns2.niceisp.com, which are commonly associated with abandoned or transitional zones. The site’s HTML title resolves to "www.cow.swap‑main.net", offering no additional contextual clues. Threat intelligence feeds have recorded the domain as a crypto‑related phishing campaign; it is classified as a generic phishing operation with a specific crypto scam focus.

PhishDestroy has actively blocked the domain, and at least one external blocklist also contains the entry. VirusTotal analysis shows that 10 of 93 scanned security vendors flagged the domain as malicious, indicating a moderate consensus of compromise. No public IP address, hosting ASN, or SSL certificate information is available in the current dataset, and no safe‑browsing or OTX identifiers were reported. The absence of these details limits a full infrastructure profile, but the combination of recent registration, disposable nameservers, and multiple vendor detections suggests a purpose‑built malicious site that was taken down shortly after deployment.

Defenders should continue to deny any network traffic to cow.swap‑main.net, add the domain to internal blocklists, and monitor for derivative subdomains or similarly registered variations. Ongoing observation of the registrar’s future registrations may reveal a pattern of rapid‑turnover domains used for crypto phishing. Until further forensic evidence emerges, the domain should be treated as hostile and excluded from any trusted access lists.