swaouz[.]com

This domain is flagged as an elevated-risk threat specializing in cryptocurrency exchange impersonation, designed to facilitate credential theft. Analysis indicates the infrastructure mimics legitimate trading platforms to deceive users into disclosing wallet credentials or transferring digital assets to attacker-controlled addresses. The specific threat type—credential theft targeting cryptocurrency holders—aligns with observed tactics in recent phishing campaigns exploiting trust in digital asset services.

Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain swaouz.com, registered on February 21, 2026, through NiceNIC International Group Co., Limited, resolves to IP address 172.67.145.13. It is detected by 4 out of 95 security vendors on VirusTotal and appears on one security blocklist, while Gridinsoft assigns a trust score of 0/100. The site employs Cloudflare for hosting and protection, alongside technologies such as Node.js, Vue.js, and Express, which are commonly used in both legitimate and malicious web applications. The SSL certificate is issued by Google Trust Services, providing a veneer of legitimacy despite the domain’s fraudulent intent.

Mitigation steps for this threat type include immediate verification of cryptocurrency exchange URLs through official sources before entering credentials. Users should enable multi-factor authentication on all digital asset accounts and avoid interacting with unsolicited links or platforms. Organizations should block the domain and associated IP at the network level, monitor for related phishing attempts, and educate users on recognizing impersonation tactics. Given the domain’s current offline status, continuous monitoring for reactivation or similar infrastructure is recommended, as threat actors frequently repurpose or rebrand phishing sites.