biswap[.]net

Analysis of biswap.net indicates that the domain was registered on March 11 2026 and that it resolved to the IPv4 address 5.255.119.131, which is allocated to The Infrastructure Group B.V. in the Netherlands (AS60404). The site presented a page title of “FASTPANEL” and employed a parking SSL certificate, a pattern commonly observed in temporary phishing deployments. VirusTotal scans recorded three positive detections out of ninety‑four security vendors, confirming the presence of malicious code or behavior.

Independent blocklists from PhishDestroy, MetaMask, and SEAL have already listed the domain, and the domain appears on three additional security blocklists, reinforcing the consensus that it was used for a crypto‑related phishing campaign. The threat classification in the intelligence feed is a generic phishing operation with a specific crypto scam focus, and the risk level is noted as elevated. As of the report date, the site is taken offline, which limits immediate exposure but does not remove the underlying infrastructure from threat‑hunting considerations.

Defenders should continue to block the domain and its associated IP address at perimeter and DNS filtering layers, ensure that any cached credentials or tokens potentially harvested from victims are revoked, and monitor for related indicators of compromise, including the ASN and hosting provider. Because the SSL certificate is a generic parking certificate, future domains hosted on the same provider may exhibit similar patterns; therefore, security teams should consider adding the entire IP range of AS60404 to watchlists. Continuous re‑evaluation is advised in case the domain is re‑activated or the IP is repurposed for new malicious activity.