spookyswap-page[.]github[.]io

The domain spookyswap-page.github.io was registered on March 1, 2026 and is hosted on the GitHub Pages service. DNS resolution points to IP address 185.199.108.153, which belongs to the Fastly network in the United States. The site presents a valid Let's Encrypt TLS certificate (R12) and returns HTTP status 200, indicating an operational web server. The page title returned by the server is "spookyswap.net," matching the brand target spookyswap and confirming intentional brand impersonation. Intelligence flags the activity as a crypto scam, and the domain has been listed on one security blocklist and blocked by PhishDestroy. It carries a Gridinsoft trust score of 0/100, suggesting a high risk assessment. The registration was performed through GitHub, Inc., a common vector for abuse. No public malware detections have been reported, but the absence of detections does not constitute validation of safety. Content analysis beyond the title has not been disclosed, leaving the exact malicious payload or credential‑harvesting mechanisms unknown. Defenders should treat the domain as malicious, enforce network‑level blocks for the host and its IP range, monitor DNS queries for similar GitHub‑hosted subdomains, and educate users about unsolicited requests referencing spookyswap. Continuous threat‑intel updates are recommended to capture any evolving indicators of compromise associated with this infrastructure.