xn--bswap-zsa[.]com

The domain xn--bswap-zsa.com was registered on 22 December 2025 through Dynadot LLC and resolves to the IPv4 address 162.252.198.123, which is announced by AS399629 BL Networks and geolocated to the Netherlands. The authoritative name servers for the zone are ns1.dyna-ns.net and ns2.dyna-ns.net. No TLS certificate is available for the host, indicating that the service is accessible only over plain HTTP.

An HTTP request to the site returned the page title “Access Denied,” suggesting that the content has been removed or is otherwise inaccessible. The domain is currently offline, and its last known activity is flagged by two independent blocklists, PhishDestroy and ScamSniffer, confirming its classification as a crypto‑related phishing campaign. VirusTotal analysis recorded three detections out of ninety‑three scanned security vendors, reinforcing the malicious rating.

The domain appears on two additional security blocklists, though specific list identifiers are not disclosed. The primary uncertainty concerns the exact payload or credential‑harvesting mechanism, as no further page content or redirect behavior has been captured. Defenders should continue to block the domain at network perimeters, monitor the associated IP address for any resurgence, and update threat‑intel feeds with the observed indicators of compromise, including the registrar, name‑server set, and IP ASN details.