swapocicat[.]club

swapocicat.club was registered through Tucows Domains Inc. on 21 February 2026. The domain resolves to IP 172.67.140.162, which belongs to AS13335 Cloudflare, Inc. in the United States. DNS resolution uses the Cloudflare nameservers robin.ns.cloudflare.com and dilbert.ns.cloudflare.com, and the service was observed delivering content over HTTP/3. The site presented a page titled “Token Swap”, indicating a crypto‑related phishing lure, and the SSL certificate was issued by Google Trust Services under the WE1 root, confirming TLS termination at Cloudflare.

Three of ninety‑three VirusTotal scanners flagged the domain as malicious, and Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The domain appears on five public blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt and Codeesura, all of which classify it as a crypto scam. The risk level was elevated and the current status is offline, suggesting that the phishing infrastructure has been taken down or is temporarily inaccessible. Evidence confirms the use of legitimate cloud infrastructure to host the phishing page, a common tactic to evade detection.

However, no additional artifacts such as payload hashes, command‑and‑control endpoints, or phishing email samples have been published, leaving the full scope of the campaign uncertain. Defenders should continue to block the domain and its associated IP address at perimeter filters, monitor for any resurgence of the same nameservers or similar page titles, and update detection rules to flag TLS connections to the Google Trust Services‑issued certificate when paired with the “Token Swap” title. Ongoing intelligence gathering should focus on any new registrations that reuse the same registrar or nameserver pattern, as well as correlating user reports that reference the same token‑swap lure.