sunswap[.]sbs

Analysis of the domain sunswap.sbs indicates a deliberate brand impersonation campaign targeting Uniswap users. The domain was registered on February 21, 2026 and currently resolves to the IP address 111.90.157.35, which is geolocated in Hong Kong and associated with AS55639 Asia Web Service Ltd. The hosting infrastructure presents a self‑signed SSL certificate issued to dragonfly.myhostcpl.com, a pattern frequently observed in malicious crypto‑related sites. The HTTP response at the time of investigation returned a generic page titled "Default Web Site Page," offering no legitimate content and confirming the site’s placeholder nature.

Threat intelligence sources corroborate the malicious intent: AlienVault OTX lists the domain in one pulse, and PhishDestroy has actively blocked it. It also appears on a single security blocklist, reinforcing the consensus of abuse. VirusTotal scans show nine out of ninety‑three security vendors flagging the domain, while Gridinsoft assigns a trust score of zero out of one hundred, indicating a high confidence of malicious behavior.

The site is presently offline, but the infrastructure footprint remains observable. Defenders should ensure that sunswap.sbs is added to network deny lists, monitor its IP range for re‑use, and update any URL filtering policies that reference Uniswap‑related traffic. Continuous observation of the associated SSL certificate and host ASN is advised, as re‑deployment of the same infrastructure is a common tactic in crypto‑scam operations.