swap-jup[.]sbs

The domain swap-jup.sbs is currently identified as an active phishing threat specializing in crypto swap impersonation schemes. No specific brand or drainer kit has been publicly linked to this domain as of now. The campaign appears to aim at deceiving users by leveraging trust in cryptocurrency swap platforms, potentially harvesting credentials or funds.

Technical analysis reveals that swap-jup.sbs has zero detections out of 95 engines on VirusTotal, indicating it is still under the radar of most antivirus solutions. It uses a Let's Encrypt SSL certificate, which is commonly abused by threat actors due to its free and automated issuance. The domain resolves to IP address 172.67.165.240 and was registered via NICENIC INTERNATIONAL GROUP CO., LIMITED on March 28, 2026. It currently has no Google Safe Browsing (GSB) blacklist status or known blocklist entries.

Presently, swap-jup.sbs remains an active threat under investigation. Due to the zero VT detections and lack of blocklist flags, it is likely early in its campaign lifecycle but still poses a substantial risk to users engaging with crypto services. Security teams should monitor the IP and domain for emerging indicators of compromise, and end users are strongly advised to avoid interacting with this domain. Immediate response actions include blocking the IP at network boundaries and educating users about the specific crypto swap phishing threat this domain represents.