honey-swap[.]net

The domain honey-swap.net was registered on April 28, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 172.67.168.207, which is associated with a large CDN provider operating from Canada. The TLS certificate is issued by a widely recognized certificate authority and the site supports HTTP/3, indicating a modern web stack. Infrastructure analysis shows the site returns an HTTP 302 status and the page title is duplicated as “www.www.honey-swap.net”, a pattern commonly used to obscure the target brand. The Gridinsoft trust score is 0 out of 100, and the domain appears on three security blocklists. VirusTotal reports two detections out of ninety‑five scanners, reinforcing the classification as a generic phishing operation. Current intelligence confirms the presence of a generic phishing campaign, but details about the payload, phishing landing pages, or victim interaction flow remain unknown. No additional malicious files or command‑and‑control infrastructure have been observed, leaving the full scope of the attack surface uncertain. Defenders should immediately block honey-swap.net at the network perimeter and add it to URL filtering policies. Continuous monitoring of DNS queries for this domain and its associated IP range is advised, as well as alerting on any HTTP 302 redirects to similar duplicated titles. User education campaigns should warn employees about unsolicited requests that redirect to domains resembling legitimate services, particularly those that employ generic phishing tactics.