yuklaswap[.]com

Analysis of the domain yuklaswap.com indicates that it was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on 21 February 2026. The domain is hosted on Cloudflare infrastructure, using the authoritative nameservers adi.ns.cloudflare.com and peyton.ns.cloudflare.com, and resolves to the IP address 104.21.19.112. VirusTotal scans show that 2 of the 91 participating security vendors have flagged the domain as malicious, which aligns with its presence on three external blocklists and active blocks by PhishDestroy, MetaMask, and SEAL. The classification in the provided intelligence is “generic phishing,” and the domain remains active as of the report date, 1 August 2026.

No additional metadata such as SSL certificate details, HTTP response codes, page titles, or brand targeting has been released, so the exact content and lure technique remain unverified. However, the convergence of registrar data, Cloudflare hosting, multiple vendor detections, and blocklist listings provides a strong indicator that the domain is being used for phishing attempts. Defenders should continue to block DNS resolution for yuklaswap.com, add the address 104.21.19.112 to network‑level deny lists, and monitor outbound traffic for connections to the identified nameservers.

Updating endpoint protection signatures to include the two vendor detections and ensuring web‑filtering solutions reference the three blocklists will reduce exposure. Analysts should seek direct payload samples or URL captures to confirm the phishing vector and to enrich detection rules. Until further forensic evidence is obtained, the domain should be treated as high‑risk and excluded from trusted traffic.