sun[.]xn--ioswap-ql4e[.]tr7nhqjekqxgtci8q8zy4pl8otszgjlj6t[.]link

This domain is a high-risk generic phishing threat designed to impersonate cryptocurrency swap services through an Internationalized Domain Name (IDN) homograph attack. The domain mimics legitimate decentralized exchange interfaces to harvest user credentials, private keys, or seed phrases under the guise of a trusted platform. Infrastructure analysis indicates the domain was engineered to exploit visual similarities with authentic crypto services, leveraging Unicode characters to deceive users into believing they are interacting with a legitimate service provider. Evidence supporting this assessment includes detection by 15 out of 95 security vendors on VirusTotal, with Google Safe Browsing specifically flagging the domain for social engineering. The domain was registered on April 16, 2026, through Key-Systems, LLC, and currently resolves to the IP address 172.86.107.252. It appears on one security blocklist and has been assigned a trust score of 0/100, reflecting its confirmed malicious status. The domain is now offline, but its infrastructure remains a documented threat in security databases. Users who visited this domain should immediately revoke any active sessions or authorizations granted to the site. If credentials, private keys, or seed phrases were entered, affected users must transfer assets to a new wallet and monitor accounts for unauthorized transactions. System scans using updated security tools are recommended to detect potential malware or backdoors installed during the interaction. Network-level blocking of the domain and its associated IP address (172.86.107.252) is advised to prevent future exposure. Organizations should update their threat intelligence feeds to include this domain and its indicators of compromise.