usadswap[.]com

Analysis of the domain usadswap.com, created on July 31 2026, indicates that it is actively being used in a generic phishing campaign and remains under investigation. The domain resolves to the IP address 188.114.96.3 and is hosted on Cloudflare infrastructure, as evidenced by the authoritative nameservers harlan.ns.cloudflare.com and jill.ns.cloudflare.com. Registration details show the domain was recorded through the entity Fewmoretaps OU d/b/a Trustname.com, suggesting a potentially disposable or privacy‑focused registrar.

The domain has been blocked by the PhishDestroy service and appears on a single security blocklist, confirming that at least one external threat‑intel feed has flagged the host as malicious. VirusTotal records indicate that the domain was submitted to 91 scanning engines, none of which returned a detection at the time of the scan; however, the absence of detections does not constitute evidence of safety, and the scan results may be outdated given the recent creation date. No public SSL certificate details, HTTP response codes, or page‑title information are currently available, limiting the ability to assess the site’s content or any TLS‑related risk.

Given the combination of recent registration, active resolution to a Cloudflare‑served IP, inclusion on a blocklist, and confirmation by PhishDestroy, defenders should treat usadswap.com as a high‑confidence phishing indicator. Recommended mitigations include adding the domain to network and endpoint blocklists, monitoring DNS queries for the IP 188.114.96.3, and conducting periodic re‑scans of the domain on VirusTotal or similar services to capture any future changes in detection status. Organizations should also consider reviewing inbound email filters for messages containing links to this domain, as its primary observed behavior aligns with credential‑harvesting activity.