netswep[.]org

The domain netswep.org is a phishing site engaged in brand impersonation, specifically targeting users of the MetaMask cryptocurrency wallet. It presents itself as a legitimate service under the name 'Netswap - Home' to deceive victims into disclosing sensitive information, though no active drainer kit was identified. As of the latest verification, netswep.org has been taken offline, but its prior activity poses a risk to those who may have interacted with it.

Technical indicators confirm the malicious nature of netswep.org. The domain was flagged by 2 of 95 VirusTotal security vendors, including alphaMountain.ai and Webroot, and appears on 2 security blocklists (PhishDestroy and ScamSniffer). Registered through NameSilo, LLC on February 17, 2025, it resolved to the IP address 172.67.163.110, hosted by Cloudflare, Inc. in the US. No SSL certificate was issued, and the domain had only one nameserver. The observed HTTP status was 429, and Gridinsoft assigned it a trust score of 0/100.

Users who visited netswep.org should take immediate action to secure their accounts. If cryptocurrency-related credentials were entered, revoke any token approvals and transfer funds to a new wallet. For login or credential phishing, change passwords on all affected accounts, enable two-factor authentication, and monitor for unauthorized activity. Report the domain to platforms like Google Safe Browsing, MetaMask’s official abuse channels, and local cybercrime authorities to aid in mitigation efforts.