swsink[.]com

Analysis of swsink.com indicates that the domain was registered on 27 April 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolved to the IPv4 address 193.24.123.205, which is attributed to a Russian hosting entity identified as Prospero OOO. The authoritative name servers are ns3.my-ndns.com and ns4.my-ndns.com. The site was served over HTTPS using a Let’s Encrypt certificate issued under the E7 series, confirming the presence of TLS but offering no evidence of legitimate ownership.

Threat intelligence feeds list the domain on three public blocklists and it appears in a single AlienVault OTX pulse, indicating prior detection by at least one community source. VirusTotal scans show three of ninety‑one security vendors flagged the domain, reinforcing the suspicion of malicious use. Independent security products have assigned a Gridinsoft trust score of zero out of one hundred and have recorded blocks by PhishDestroy, MetaMask, and SEAL, further corroborating its classification as a phishing vector.

The domain’s risk level is marked as elevated, yet its current online status is offline, suggesting the infrastructure may have been taken down or is temporarily inactive. Defenders should continue to monitor DNS queries for the listed name servers and the associated IP address, enforce outbound filtering to block connections to this host, and incorporate the domain and IP into existing blocklists and intrusion‑detection signatures. Because the underlying payload, targeted brand, or specific phishing kit has not been publicly disclosed, analysts should treat any future re‑activation as potentially hostile and prioritize rapid investigation of any related traffic or email indicators.