swapsterbot[.]com

Analysis performed on July 25 2026 indicates that swapsterbot.com is associated with a crypto‑focused phishing operation. The domain was registered on March 11 2026 through NameCheap, Inc. and resolves to the IP address 192.142.54.77, which is allocated to AS214036 Ultahost, Inc. in the Netherlands. The hosting infrastructure presents a typical WordPress stack comprising Apache HTTP Server, PHP, MySQL, and jQuery libraries, suggesting a low‑cost website deployment often used by threat actors. A Let's Encrypt R12 certificate protects the site, which currently returns a page titled "Site is undergoing maintenance" and is listed as offline.

The MX records point to mail.swapsterbot.com and an additional host entry, indicating the domain has been configured for email delivery, a common vector for credential‑stealing campaigns. Security telemetry shows that one of ninety‑five VirusTotal scanners flagged the domain, and it appears on a single external blocklist. Gridinsoft assigns the domain a trust score of 0 out of 100, reinforcing the malicious assessment.

PhishDestroy has actively blocked the domain, confirming its involvement in phishing activity targeting cryptocurrency users. Defenders should add swapsterbot.com and its resolving IP 192.142.54.77 to network blocklists, enforce email filtering for any messages originating from its MX hosts, and monitor for future registrations or similar sub‑domains under the same nameserver set (ns1‑4.ultahost.com). Continuous threat‑intel feeds should be consulted for any emerging indicators linked to this infrastructure, and compromised credentials should be rotated if any interaction with the domain is suspected.