aethir-swap[.]xyz

Analysis indicates that the domain aethir-swap.xyz was registered on July 09, 2026 through Spaceship, Inc. and is currently resolving to the IP address 186.2.175.35. The authoritative name servers for the zone are launch1.spaceship.net and launch2.spaceship.net, both of which are typical of the registrar’s infrastructure. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy feed, confirming that at least one reputable anti‑phishing service has identified it as malicious.

VirusTotal scans show that 2 of 91 security vendors have flagged the domain, providing independent vendor‑level corroboration of its suspicious nature. No additional public intelligence such as OTX references, Safe Browsing status, or SSL certificate details is available in the current data set, and the site’s page title or content has not been captured, leaving the exact phishing payload and target brand unspecified. Given the recent creation date, the presence on a blocklist, and multiple vendor detections, defenders should treat the domain as high‑risk.

Recommended actions include adding the domain to network and endpoint deny lists, monitoring DNS queries for the IP 186.2.175.35, and employing sink‑hole or redirect controls to prevent user access. Continuous re‑evaluation is advised, as further evidence such as page content or additional vendor detections may emerge, refining the threat profile.