# PhishDestroy threat dossier — trueusd-swap.org ================================================================ Fetched: 2026-07-13 12:46:03 UTC Canonical: https://phishdestroy.io/domain/trueusd-swap.org/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Brand Impersonation ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 1/91 security vendors flagged this domain Flagging vendors: SOCRadar URLQuery: 2 detections AlienVault OTX: 1 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 186.2.175.35 (BZ, Belize City) ASN: AS59692 IQWeb FZ-LLC Hosting org: AS59692 IQWeb FZ-LLC Registrar: Fewmoretaps OU d/b/a Trustname.com !!! REGISTRAR INTEGRITY ALERT — Trustname / Fewmoretaps OU !!! Trustname (IANA #4318) is a shell company declaring EUR 120 annual revenue, 1 employee, negative equity, Belarusian ownership. Explicitly advertises itself as 'bulletproof' in its DNS TXT records. Primary source: https://phishdestroy.io/trustname-bulletproof-exposed Nameservers: ares.trustname.com, ns1.anycastdns.cz, ns2.anycastdns.cz, zeus.trustname.com Registered: 2026-07-06 Expires: 2027-07-06 Page title: TrueUSD Swap — Swap TUSD, USDT & TRX on TRON | Staking & Liquidity Pools HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR2 Expires: 2026-10-05 Status: INVALID chain Fingerprint: 625b7369b6ec7f22f8133324d0c6d673b329e328e2dbf2174583ea32aaa0c7b7 Subject Alternative Names (related infrastructure — often same operator): - www.trueusd-swap.org ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-07-06 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-10 11:51:51 UTC (by PhishDestroy tracker) First reported: 2026-07-12 21:51:40 UTC (abuse notice filed) Last verified: 2026-07-13 12:20:40 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f4b6f-9c22-744a-8fea-4a975a95e5c1/ URLQuery: https://urlquery.net/report/5c8e3147-48ff-41bf-96de-35130a69f152 Wayback Machine: https://web.archive.org/web/*/trueusd-swap.org crt.sh CT logs: https://crt.sh/?q=%25.trueusd-swap.org Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=trueusd-swap.org AlienVault OTX: https://otx.alienvault.com/indicator/domain/trueusd-swap.org URLhaus: https://urlhaus.abuse.ch/host/trueusd-swap.org/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-10 11:55:09 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] The domain trueusd-swap.org is currently under investigation for generic phishing activity targeting users of the TrueUSD (TUSD) cryptocurrency. Analysis indicates this infrastructure is designed to impersonate legitimate token swap or exchange portals, potentially facilitating unauthorized transactions or credential harvesting. As of the latest assessment, the domain remains active and unblocked by most security vendors. Infrastructure analysis reveals the domain was registered on July 06, 2026, through Fewmoretaps OU operating under the trade name Trustname.com. It resolves to the IP address 186.2.175.35, which has not yet been flagged in public blocklists. VirusTotal telemetry reports zero detections across 95 security vendors, suggesting the campaign may still be in its early stages or employing evasion techniques. The domain presents a Let's Encrypt SSL certificate, which while providing basic encryption, does not validate legitimacy. No historical records or prior malicious associations were identified for this specific domain or its hosting infrastructure. Current status shows the domain remains operational with no confirmed takedown actions. Security teams are advised to monitor network traffic for connections to 186.2.175.35 and the domain trueusd-swap.org, particularly in environments handling cryptocurrency transactions. Organizations should consider implementing DNS-based blocking for the domain and IP, while users should verify all TrueUSD-related portals through official channels only. Given the absence of detections, this domain warrants continued observation for emerging threat patterns. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260712-DC177A TLS cert SHA-256: 625b7369b6ec7f22f8133324d0c6d673b329e328e2dbf2174583ea32aaa0c7b7 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/trueusd-swap.org/ JSON API: https://api.destroy.tools/v1/check?domain=trueusd-swap.org Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 178,105 domains (49,797 alive under monitoring, 128,308 confirmed takedowns/dead). Site: https://phishdestroy.io