swell-rpc[.]com

The domain swell-rpc.com is flagged for brand impersonation, specifically targeting the brand ankr. There is no indication of a crypto drainer kit being used. The intent appears to be to deceive users into believing the site is affiliated with ankr, potentially to gain unauthorized access to credentials or other sensitive information.

Infrastructure analysis reveals that the domain has a VirusTotal score of 3/95, indicating that a small number of security vendors have flagged it as suspicious. The domain is registered through Amazon Registrar, Inc., and resolves to the IP address 20.79.151.61. It was created on December 04, 2024. The site employs HSTS and Google Analytics technologies. The SSL certificate is issued by Google Trust Services. Additionally, the domain appears in one threat intelligence pulse on AlienVault OTX and has a Gridinsoft trust score of 0/100, which is extremely low. The domain is currently listed on one security blocklist, PhishDestroy.

The current status of swell-rpc.com is offline, which suggests that the domain has been taken down. However, the low Gridinsoft trust score and appearance on a security blocklist indicate that the domain was previously engaged in malicious activities. Despite the domain being offline, the risk remains elevated due to the potential for reactivation. It is recommended that users exercise caution and avoid interacting with this domain, even if it becomes active again. Security teams should monitor for any signs of the domain coming back online and take appropriate action to mitigate the risk.