myswanbitcoin[.]com

Analysis indicates that myswanbitcoin.com was registered on July 30 2025 through Gransy, s.r.o. and resolves to the IP address 159.100.18.138, which is hosted in Germany under Autonomous System AS214036 (Ultahost, Inc.). The domain presents an SSL certificate identified as R11, but the site is currently offline, confirming the "offline" status reported. The page title observed during the brief capture phase reads "Claim Reward with Swan, your Bitcoin specialists – Swan Bitcoin," suggesting a claim‑reward narrative that aligns with the listed crypto‑scam classification. The domain is explicitly marked as impersonating the Metamask brand, indicating a targeted brand‑impersonation campaign.

Threat‑intelligence aggregators provide additional corroboration. VirusTotal records five detections out of ninety‑three scanning engines, and Gridinsoft assigns a trust score of zero out of one hundred, reflecting a high confidence of malicious intent. AlienVault OTX references the domain in a single threat‑intel pulse, and five independent blocklists—PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura—have already listed the host. The domain also appears on a total of five broader security blocklists, reinforcing its reputation as a malicious actor.

Uncertainty remains around the exact infrastructure used for payload delivery, as no malicious sample hashes or URLs beyond the domain itself have been disclosed. The offline status limits immediate observation of any active phishing forms or malware. Consequently, defenders should continue to block the domain at perimeter defenses, monitor DNS queries for the IP 159.100.18.138, and update threat‑intelligence feeds with the provided indicators. Additional scrutiny of traffic to the associated IP and any future re‑activation of the domain is advised, as the campaign may resume under the same or a variant of the current infrastructure.