swapznoe[.]io

This domain, swapznoe.io, is identified as a cryptocurrency credential harvesting site designed to mimic legitimate wallet services. Analysis indicates it targets users by presenting fraudulent login interfaces to capture private keys, seed phrases, or account credentials. The infrastructure employs deceptive tactics typical of phishing campaigns, including the use of Cloudflare to obscure hosting details and evade detection. The domain currently returns a 502 Bad Gateway error, suggesting it may have been taken offline or is undergoing reconfiguration to avoid scrutiny. Evidence supporting this assessment includes detection by 9 out of 95 security vendors on VirusTotal, indicating a high likelihood of malicious intent. The domain was registered on November 16, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with suspicious domains. It resolves to the IP address 188.114.96.3 and is blocked by four security blocklists, including Codeesura and Polkadot. Additionally, the domain has a Gridinsoft trust score of 0/100, further confirming its classification as a high-risk entity. Technologies detected include Cloudflare Browser Insights and HTTP/3, which are often leveraged to enhance obfuscation and resilience against takedowns. Users who visited swapznoe.io or interacted with its content should take immediate action to mitigate potential compromise. First, revoke any permissions granted to the domain in wallet applications or browser extensions. Second, transfer assets from any potentially exposed wallets to new, secure addresses. Monitor accounts for unauthorized transactions and enable multi-factor authentication where available. If credentials were entered, assume they are compromised and avoid reusing them across other platforms. Report the domain to relevant security teams or blocklist providers to aid in broader mitigation efforts.