swap-iup[.]ac

The domain swap-iup.ac was registered on February 21, 2026 and is currently listed as offline. Intelligence sources indicate that the site was used for a crypto‑related phishing campaign and has been taken down by the mitigation service PhishDestroy. Network resolution points to the IP address 172.67.164.189, which is owned by Cloudflare, Inc. and geolocated to Canada.

The domain appears on a single security blocklist, suggesting limited exposure in existing threat‑sharing feeds. VirusTotal records show that the domain was scanned by 93 antivirus and URL‑reputation vendors; none of the scanners reported a detection at the time of analysis, though the absence of a detection does not constitute a safety guarantee. No additional public data such as SSL certificate details, HTTP response codes, page title, or brand targeting has been disclosed, leaving the exact content of the phishing page unverified.

Given the confirmed crypto‑scam classification, the association with a Cloudflare edge node, and the recent creation date, defenders should assume the domain was leveraged for credential harvesting or malicious transaction redirection. Recommended mitigations include adding swap‑iup.ac to network deny lists, updating endpoint URL filtering policies, and monitoring for any re‑appearance of the domain or associated IP address in future threat feeds. Continuous observation of Cloudflare‑associated IP ranges for anomalous activity is advised, as the infrastructure could be repurposed for new campaigns.