io-swapcrypto[.]org

This domain, io-swapcrypto.org, operates as a cryptocurrency phishing site designed to deceive users into disclosing wallet credentials or transferring digital assets to attacker-controlled addresses. The site mimics legitimate cryptocurrency swap platforms, presenting a fraudulent interface that prompts users to connect wallets or input private keys under the guise of executing transactions. Such schemes typically result in immediate asset theft, with funds transferred to wallets beyond the victim's recovery reach. Analysis indicates the domain was registered on May 21, 2026, through Web Commerce Communications Limited dba WebNic.cc, a registrar frequently associated with high-risk domains. Detection metrics reveal that 4 out of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on three distinct security blocklists. The domain resolves to the IP address 188.114.97.3, which is proxied through Cloudflare, a common tactic to obscure hosting infrastructure and evade takedown efforts. Additional technical indicators include the use of Cloudflare Browser Insights and HTTP/3, further suggesting an attempt to mimic legitimate service behavior. Users who visited io-swapcrypto.org or interacted with its content should immediately cease all engagement and revoke any wallet permissions granted to the site. It is critical to audit connected wallets for unauthorized transactions and transfer remaining assets to a new, secure wallet. Monitor financial and identity-related accounts for suspicious activity, as phishing sites may harvest additional personal data. Report the domain to relevant security teams and blocklists to aid in broader mitigation efforts. If credentials were entered, assume they are compromised and update them across all platforms where they may have been reused.