blswap[.]net

Analysis of the domain blswap.net indicates it is actively engaged in cryptocurrency-related phishing activity, as classified by one security vendor and corroborated by its infrastructure and registration details. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and remains operational as of July 12, 2026. It resolves to the IP address 188.114.96.3, which is part of AS13335 (Cloudflare, Inc.) and geolocated in the United States. The domain employs Cloudflare nameservers (april.ns.cloudflare.com and kayden.ns.cloudflare.com) and utilizes HTTP/3, with an SSL certificate issued by Cloudflare TLS Issuing ECC CA 3. The page title, 'www.www.blswap.net,' is anomalous and suggests either misconfiguration or intentional obfuscation. The domain currently returns an HTTP 302 status code, which may indicate a redirect to another malicious or intermediary page, though the final destination remains unconfirmed. Two of 93 security vendors on VirusTotal have flagged this domain, aligning with its classification as a cryptocurrency scam. No specific brand impersonation is evident from the available data, but the domain name and scam type imply it targets users of cryptocurrency swap or exchange services. Defenders should treat this domain as high-risk and implement blocking measures at the DNS or network level. Given its association with Cloudflare infrastructure, additional scrutiny of related domains or IPs within the same ASN may be warranted. The domain's continued activity and use of evasion techniques (e.g., Cloudflare, HTTP/3) suggest it is part of an ongoing campaign. Further analysis of the redirect chain and any associated payloads is recommended to determine the full scope of the threat.