rsusi-aqaaa-aaaag-abhda-cai[.]ic0[.]app

Analysis of the domain rsusi-aqaaa-aaaag-abhda-cai.ic0.app indicates active phishing infrastructure targeting users of a platform identified by the page title 'Chapswap Finance.' The domain is registered through Squarespace Domains II LLC and resolves to the IP address 195.5.171.241. SSL certification is provided by Let's Encrypt, a common feature in both legitimate and malicious domains, offering no definitive indication of intent on its own. The presence of HSTS, Google Tag Manager, and Google Analytics suggests an attempt to mimic legitimate financial or cryptocurrency service pages, though these technologies are also routinely employed in phishing campaigns to enhance credibility or track victim interactions. As of July 12, 2026, the domain appears on two security blocklists and is flagged by 13 of 95 security vendors in a recent scan. Detection by PhishDestroy and Enkrypt further corroborates its classification as malicious. The domain remains active, posing an ongoing risk to users who may be deceived into interacting with it under the guise of a legitimate financial service. Defenders should prioritize blocking access to this domain at the network level, particularly in environments where financial or cryptocurrency-related services are accessed. Monitoring for connections to the resolving IP 195.5.171.241 may also aid in identifying compromised systems or additional malicious domains hosted on the same infrastructure. Given the limited public intelligence on the specific tactics or payloads associated with this domain, further analysis of network traffic or endpoint logs is recommended to determine the full scope of the threat.