swapnow[.]gg

Analysis of swapnow.gg indicates an active crypto drainer phishing domain targeting cryptocurrency users. The domain resolves to 64.29.17.65, hosted on infrastructure associated with Vercel, Inc. in the US. A 307 HTTP redirect status is observed, which may be used to obfuscate malicious routing. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. Technologies detected include Node.js, React, Next.js, and Webpack, alongside HSTS, suggesting a modern web stack that could be leveraged for credential harvesting or wallet-draining scripts. Security vendors have flagged the domain, with 14 out of 91 engines on VirusTotal identifying it as malicious. It appears on three security blocklists and is blocked by at least three entities, including MetaMask, which aligns with its classification as a crypto drainer. AlienVault OTX records the domain in two threat intelligence pulses, further corroborating its malicious status. The Gridinsoft trust score of 0/100 reinforces the high-risk assessment. Defenders should treat this domain as actively hostile. Block resolution at the DNS or network level, and alert users attempting to access it. Given the crypto drainer classification, prioritize monitoring for wallet interactions or transaction requests originating from this domain. No confirmed brand impersonation is identified in the available data, but the page title 'SwapNow' suggests a focus on cryptocurrency exchange or swapping services. Further analysis of the site's content or scripts may be required to determine exact tactics, though current indicators are sufficient to justify immediate containment.