sunswap[.]one

The domain sunswap.one is currently active and has been identified as a high‑risk brand‑impersonation site targeting Uniswap users. The site presents a page titled “$WAR Token Airdrop”, a classic lure used to harvest cryptocurrency wallets. Analysis indicates the page is built with a publicly available Airdrop Scam phishing kit, aligning with the observed cryptocurrency‑scam behavior. The domain was registered on March 23 2026 through GoDaddy.com, LLC and resolves to the IPv4 address 185.196.9.115, which is allocated to Global‑Data System IT Corporation in Switzerland (CH). DNS resolution is handled by ns13.domaincontrol.com and ns14.domaincontrol.com, both standard GoDaddy name servers. The web server runs Ubuntu with Nginx, and front‑end assets are delivered via jsDelivr. An SSL certificate issued by Let’s Encrypt (R12) is present, providing HTTPS with a valid chain. VirusTotal scans have flagged the domain on 16 of 95 security vendors, and the Gridinsoft trust score is 0 / 100, indicating a strong malicious reputation. The site is listed on one security blocklist and has been blocked by PhishDestroy, confirming active mitigation by at least one anti‑phishing service. The HTTP response code is 200, suggesting the page is fully served without error. While the infrastructure details are concrete, the exact operator behind sunswap.one remains unknown; no attribution to an ASN or affiliated group is available. Defenders should block the domain and its associated IP at perimeter firewalls, update DNS filtering policies, and monitor for similar “airdrop” lure patterns that reference Uniswap. Users should be warned to ignore unsolicited airdrop offers and to verify URLs against official Uniswap domains.