swap-change[.]net

This domain, swap-change.net, is flagged as a crypto drainer phishing site designed to illicitly extract cryptocurrency from victims' wallets. Analysis indicates the site employs malicious JavaScript to mimic legitimate wallet interfaces, tricking users into authorizing transactions that drain funds to attacker-controlled addresses. No specific brand impersonation has been confirmed, but the infrastructure aligns with known crypto drainer kits observed in prior campaigns targeting decentralized finance (DeFi) users. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.82.218, which is part of a content delivery network known for obfuscating malicious infrastructure. Detection metrics show 4 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one security blocklist. The domain's trust score is 0/100, and it is not listed in Google Safe Browsing databases at the time of analysis. Technologies detected include Cloudflare and HTTP/3, which are commonly leveraged to evade detection and enhance delivery speed. The domain is currently offline, likely due to takedown efforts or abandonment by the threat actor. However, the elevated risk persists as the infrastructure may be reactivated or repurposed for future campaigns. Users who interacted with the domain are advised to revoke any wallet authorizations, monitor transaction histories for unauthorized activity, and replace compromised credentials. Organizations should update blocklists to include the domain and associated IP address to prevent future exposure. Continuous monitoring of related infrastructure is recommended due to the transient nature of such threats.