swopbel[.]com

Analysis of swopbel.com indicates the domain has been actively used for a cryptocurrency‑focused phishing campaign. The site’s HTML title, “SwapFor: Your Gateway to Vela‑Exchange in DeFi”, suggests an attempt to lure victims into a decentralized‑finance token swap service. The domain was registered on 5 September 2025 through NameSilo, LLC and is currently hosted behind Cloudflare’s network (ASN 13335) with the IP address 104.21.94.103 located in the United States. The SSL certificate is identified as “WE1”, which provides no additional trust signals.

Independent threat‑intelligence feeds have added the domain to two blocklists—PhishDestroy and ScamSniffer—both of which classify it as a crypto scam. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. VirusTotal analysis shows that 1 of 93 scanning engines flagged the domain, confirming at least one detection of malicious content. The domain’s status is reported as offline, indicating that the malicious site is no longer reachable at the time of this check, but the infrastructure remains observable.

Defenders should continue to block traffic to the resolved IP address and enforce DNS‑level denial for swopbel.com, especially for users accessing DeFi platforms. Monitoring of Cloudflare‑hosted IP ranges for similar patterns is recommended, as the hosting provider can be leveraged for rapid re‑deployment. Because the page content has not been captured, the exact phishing vector (e.g., credential‑stealing form or malicious smart‑contract link) remains unknown; analysts should treat the domain as a confirmed crypto‑phishing indicator and incorporate it into threat‑intel feeds until further evidence clarifies the payload.