syshiswap[.]net

Analysis indicates that syshiswap.net was registered on 22 December 2025 through NiceNIC International Group Co., Limited and is hosted on a Cloudflare name server pair (gerald.ns.cloudflare.com, ziggy.ns.cloudflare.com). The domain resolves to the IPv4 address 146.103.40.253, which is assigned to AS215311 Regxa Company for Information Technology Ltd and geolocated to Germany. No TLS certificate is presented, confirming the absence of HTTPS protection. The site is currently taken offline, and the current HTTP status is unavailable. Threat intelligence categorises the domain as a crypto‑related scam; the specific classification appears in the supplied intelligence as “Crypto Scam”.

The domain has been flagged by three of ninety‑three VirusTotal scanners, listed on one external blocklist, and is actively blocked by the PhishDestroy mitigation service. Independent reputation scoring from Gridinsoft assigns a zero‑point trust rating (0/100), indicating an extremely low confidence in legitimacy. The combination of a newly created domain, lack of encryption, low trust score, and multiple detections aligns with typical infrastructure patterns used for fraudulent cryptocurrency schemes. Uncertainty remains regarding the exact payload or phishing page content, as no page title or content hash has been disclosed.

Defenders should add 146.103.40.253 and syshiswap.net to network‑level deny lists, enforce DNS filtering for the domain, and monitor for any resurgence of activity. Because the hosting provider is Cloudflare, any future re‑hosting could occur behind the same name‑server pair, so continuous DNS watch‑lists are advised. Incident response teams should also verify that internal users have not accessed the domain recently and, if needed, conduct endpoint scans for artifacts associated with the three VirusTotal detections. Ongoing vigilance is recommended given the elevated risk rating and the domain’s active inclusion on blocklists.