sunswap[.]nexus

The domain sunswap.nexus was observed hosting a site that claimed to be a decentralized exchange for TRON, as indicated by the page title “SunSwap | A decentralized exchange protocol for automated liquidity provision on TRON.” Technical analysis shows the domain resolves to the IP address 172.67.215.129, which belongs to AS13335 Cloudflare, Inc., and the registration was performed through Cloudflare, Inc. No SSL certificate was presented, leaving the connection unencrypted. The infrastructure is listed on four security blocklists and has been actively blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. Threat intelligence feeds corroborate the malicious nature: AlienVault OTX references the domain in 13 separate pulses, and VirusTotal reports that 14 of its 95 scanning engines flagged the site.

The Gridinsoft trust score is 0 out of 100, indicating a lack of credibility. Nameserver records point to lynn.ns.cloudflare.com and raquel.ns.cloudflare.com. The site currently reports an offline status, suggesting the operators have taken it down, but the underlying infrastructure remains reachable and could be re‑used.

Defenders should add sunswap.nexus to internal blocklists, monitor the associated IP 172.67.215.129 for any future activity, and enforce TLS inspection to detect any re‑emergence of the domain without a valid certificate. Continuous threat‑intel feeds should be consulted for new pulses that reference the domain, and any observed traffic to the Cloudflare nameservers should be scrutinized for potential re‑deployment of the brand‑impersonation campaign targeting TRON users.