[admin-gilrex]

Summary

Requesting the addition of 21 suspected phishing and brand-impersonation domains targeting Swapuz, a cryptocurrency exchange operating at https://swapuz.com/.

These domains are not affiliated with the legitimate Swapuz service.

Evidence

• All 21 domains closely resemble the official Swapuz domain.
• Previous technical investigations found the official Swapuz favicon (MD5 59190d6ae3805369def85820963ac1ab) and identical obfuscated "Loading..." HTML (MD5 d23d2e9e16dfbdd17ad6b157428e3a0b).
• The domains were registered through NiceNIC in closely grouped registration batches.
• On October 26, 2026 (UTC+8), Cloudflare phishing warnings were recorded for 19 of the 21 domains.
• After a coordinated Cloudflare account migration, the domains were observed to be unreachable on October 27, 2026. They remained registered without confirmed registrar-level suspension.

The websites' current unavailability does not prevent them from potentially being reactivated.

References

Legitimate website: https://swapuz.com/

Trademark owner: GRAVT, s.r.o.

EU trademark: EUTM No. 018725912

MetaMask phishing report: MetaMask/eth-phishing-detect#306013

NiceNIC registrar complaint: #816568

Reporting organisation: Gilrex, authorised brand-protection agent for Swapuz.

Requested action

Please review and add these 21 suspected Swapuz impersonation domains to Phantom's phishing blocklist to help protect wallet users against potential phishing and reactivation.

The reported evidence supports suspected phishing and impersonation; direct credential or wallet theft has not been independently established.

Summary by CodeRabbit

• Chores
  • Updated the blocked-site list with 21 URL entries, including swaouz.com and several spelling variants of swapuz.com. These addresses are now included in the list.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: af5e787b-ef7a-4859-a687-87a1506622c3

Commits

Reviewing files that changed from the base of the PR and between 5030186 and 773b846.

Files selected for processing: 1

• blocklist.yaml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

The blocklist adds 21 URL entries, including swaouz.com and spelling variants of swapuz.com.

Changes: Blocklist URL additions

Layer / File(s)	Summary
Add URL entries blocklist.yaml	The blocklist adds 21 URLs, including swaouz.com, swapoz.com, swappuz.com, and swwapuz.com.

Priority: Normal

Change: Other

Merge Risk: Minimal · up to 773b8

The blocklist-only change is ready to merge after normal checks.

Architecture risk: Low · up to 773b8

The change affects 1 system.

Changed systems: blocklist.yaml

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — blocklist.yaml (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in blocklist.yaml: Adds 21 URL entries to the blocklist, including swaouz.com and variants such as swapoz.com, swappuz.com, and swwapuz.com.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: adding 21 suspected Swapuz phishing domains to the blocklist.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within survi…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}