sunswap-tron[.]lat

This domain, sunswap-tron.lat, is actively impersonating a Tron-based decentralized finance (DeFi) protocol to facilitate fake staking operations. Registered on April 16, 2026, through Dynadot LLC, the domain resolves to IP address 104.21.6.179, hosted on Cloudflare infrastructure in Canada. Nameservers javier.ns.cloudflare.com and magali.ns.cloudflare.com further confirm Cloudflare’s role in its hosting. The site presents itself with the page title 'SUN | Leading DeFi protocol on Tron: swap, stake, earn, liquidity mining and governance,' directly targeting users of the SUN DeFi ecosystem. Analysis indicates the domain is flagged on three security blocklists and appears in one AlienVault OTX threat intelligence pulse, reinforcing its classification as malicious. It is currently blocked by at least three security providers, including MetaMask and SEAL. The SSL certificate, issued by Let’s Encrypt (serial E8), does not mitigate the risk, as legitimate certificates are commonly abused in phishing campaigns. The domain’s HTTP status returns 200, confirming it is operational and serving content. No vendor detections were recorded in the most recent VirusTotal scan, though this absence does not confirm safety. The Gridinsoft trust score of 0/100 aligns with its malicious classification. Defenders should treat this domain as high-risk infrastructure, particularly for users interacting with Tron-based DeFi platforms. Blocking resolution at the DNS level or via endpoint protection is recommended. Further investigation into associated wallet addresses or backend infrastructure may reveal additional fraudulent components.