swaponix[.]su

Analysis of the domain swaponix.su indicates active credential-harvesting infrastructure targeting cryptocurrency wallet users. As of August 4, 2026, the domain is flagged by six security blocklists, including PhishDestroy, MetaMask, Polkadot, SEAL, and Enkrypt, which classify it as a high-risk phishing site. VirusTotal scans show 10 of 91 security vendors detecting malicious activity, though the specific payload or phishing kit remains unconfirmed. The domain resolves to hosting infrastructure with no additional brand or kit attribution available in public threat feeds.

Infrastructure analysis reveals the domain is registered under the .su TLD, which has historically been associated with malicious campaigns due to relaxed registration policies. No Safe Browsing or OTX pulse data is currently available, limiting visibility into recent attack patterns or victim targeting. The HTTP status and SSL certificate details are not publicly documented, though the domain remains accessible and operational.

Defenders should treat this domain as an active threat, particularly for users of MetaMask, Polkadot, and other wallet services. Immediate blocking at the DNS or network level is recommended, along with monitoring for credential reuse attempts from harvested data. Further investigation into hosting providers and registrar details may yield additional takedown opportunities, though no registrar or ASN data is presently available for this domain.