swanbitcoinpolicy[.]info

This domain, swanbitcoinpolicy.info, is identified as a brand impersonation threat targeting Bitcoin users through a fraudulent DocuSign-themed interface. Analysis indicates the site presents a "Download to View Document" prompt, a common tactic to distribute malicious payloads or harvest login credentials. The domain specifically mimics cryptocurrency services, increasing the likelihood of targeting wallet holders or exchange users. Infrastructure analysis reveals the domain was registered via NICENIC INTERNATIONAL GROUP CO., LIMITED on May 27, 2024, and resolves to the IP address 104.21.8.58, hosted on Cloudflare’s AS13335 network. Detection metrics show 22 out of 95 security vendors on VirusTotal flagged the domain as malicious. It appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by Let’s Encrypt, a detail often exploited by threat actors to lend superficial legitimacy to phishing sites. As of the latest assessment, swanbitcoinpolicy.info has been taken offline, reducing immediate exposure. However, the domain’s registration remains active, and similar infrastructure may be reused for future campaigns. Users who interacted with the site should assume potential credential compromise and monitor associated accounts for unauthorized activity. Organizations are advised to update blocklists with the provided indicators and educate users on recognizing cryptocurrency-themed phishing attempts.