The three facts
The only official domain is fbtswap.ir. Not a variation with a hyphen, not a different extension, not a lookalike with a substituted character. Type it or use a bookmark you created yourself; search results and links in messages are both places where a fake outranks the real thing.
The only contact address is fbtswap@gmail.com. And the rule that makes the other two usable: we never contact users first. Not by direct message, not by phone, not by email. A message that arrives unsolicited claiming to be us is not us, no matter how well it is written.
What we will never ask for
A recovery phrase or private key, under any circumstance. A remote-access or screen-sharing session. A transfer to a "safe" or "verification" address. A payment to unlock, release or recover funds. Each of these appears in real attacks, and each is conclusive: the request itself is the proof.
There is also no legitimate airdrop, giveaway or migration that needs a seed phrase. The entire category is a lure, and it works because it arrives when someone is already excited about something else.
If you have already been contacted
Stop responding. Do not click anything in the message, including an unsubscribe link. If you connected a wallet to a site you now doubt, revoke its approvals immediately rather than waiting to see whether anything happens, because an approval can be used at any later time.
If a recovery phrase was entered anywhere other than your own wallet, treat that wallet as compromised and move what remains to a newly generated one. Speed matters more than certainty here; a wallet you move out of unnecessarily costs you a little gas, and the alternative costs everything.
Reaching us legitimately
Email fbtswap@gmail.com. For a security issue, the scope and contact are also published in security.txt at the well-known path, as RFC 9116 specifies. Include the URL and a specific description — that is the difference between a report we can act on and one we cannot.
What we cannot do by email is recover funds, reverse a transaction or restore a lost phrase. Those limits are described in full on the limitations page, and they apply no matter how the request reaches us.