swap[.]cow[.]fi[.]weth[.]eu[.]com

Analysis indicates that swap.cow.fi.weth.eu.com is currently flagged as a high-risk active domain tied to cryptocurrency-related generic phishing. Infrastructure analysis reveals that the domain resolves to IP address 172.67.157.48 located in the United States under AS13335. It uses nameservers ns1.centralnic.net through ns4.centralnic.net and employs Cloudflare technologies including HTTP/3 along with an SSL certificate issued by Let's Encrypt. The domain was registered via Instra Corporation Pty Ltd on February 21 2026 and continues to show an HTTP status of 521 with a page title referencing a connection timeout.

The threat classification stems from its appearance on one security blocklist along with detection by PhishDestroy. VirusTotal reports that three out of 95 security vendors flag the domain. Registration details place creation in early 2026 which aligns with normal timelines for the current reporting date of July 12 2026. The subdomain structure attempts to mimic legitimate cryptocurrency swap infrastructure associated with weth.eu.com yet the actual response codes and timeout indicators suggest operational instability or deliberate redirection tactics.

Uncertainties remain regarding the exact payload delivery mechanisms or downstream command-and-control endpoints because only partial HTTP responses are observable. Concrete evidence is limited to the listed nameserver configuration IP resolution and vendor detections without additional ASN-level routing paths or kit fingerprints available in the intelligence set. Defenders should block the domain at DNS and network perimeters while monitoring for similar registrations under the centralnic.net nameserver set. Incident responders are advised to correlate traffic to 172.67.157.48 with user reports of unauthorized cryptocurrency transactions and to update internal allow lists to exclude this fully qualified domain name.