sudoswap[.]us

Analysis of sudoswap.us, taken offline as of the report date, shows multiple indicators of malicious activity consistent with a crypto‑related phishing operation. The domain was registered on 15 October 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and is served by Cloudflare nameservers carioca.ns.cloudflare.com and ian.ns.cloudflare.com. DNS resolution points to IP 5.255.119.131, which belongs to AS60404 The Infrastructure Group B.V. located in the Netherlands. No TLS certificate is present, leaving the site exposed to clear‑text traffic and confirming the lack of a legitimate HTTPS service. The page title returned by the server is “FASTPANEL”, a generic control‑panel identifier that does not correspond to any known legitimate service associated with the domain.

Threat‑intel feeds have flagged the domain: PhishDestroy lists it as blocked, and it appears on at least one external security blocklist. VirusTotal scans show that 12 of 95 scanning engines flagged the host, indicating a moderate level of consensus among anti‑malware vendors. The Gridinsoft trust score is 0 out of 100, reinforcing the assessment of high risk. The listed scam type is “Crypto Scam”, which aligns with the broader classification of generic phishing. Uncertainty remains regarding the specific phishing payload or target victims, as the content of the site beyond the title has not been captured.

No evidence of a valid SSL certificate, no known brand impersonated in the title, and no publicly disclosed phishing kit were observed. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of the domain or related subdomains, and add the IP address 5.255.119.131 to deny‑list rules. Given the registrar’s public‑domain focus, future registrations from the same registrar should be scrutinised. Continuous re‑evaluation of VirusTotal and other sandbox reports is advised to capture any evolving malicious behavior.