sundogswap[.]org

Analysis of sundogswap.org shows the domain was registered on July 29, 2026 through Fewmoretaps OU d/b/a Trustname.com. The registration record lists four authoritative name servers—ares.trustname.com, ns1.anycastdns.cz, ns2.anycastdns.cz, and zeus.trustname.com—indicating a mixed DNS infrastructure that leverages both Trustname‑operated and Anycast services. DNS resolution points to the IPv4 address 186.2.175.35, which remains active as of the report date (August 01, 2026). The domain appears on one security blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that a reputable anti‑phishing service classifies the site as malicious.

VirusTotal has scanned the domain and 9 of 91 security vendors flagged it as malicious, providing independent corroboration of its phishing nature. The supplied intelligence classifies the threat as generic phishing and assigns a high risk level, reflecting a strong likelihood that the site is used to harvest credentials or personal data. No additional evidence such as SSL certificates, HTTP response codes, page titles, or content analysis is available, so the full payload and any targeted brands remain unknown. The domain’s recent creation date places it among newly deployed malicious infrastructure, and its continued activity indicates an operational campaign.

Defenders should add sundogswap.org and its IP 186.2.175.35 to outbound and inbound deny lists, monitor DNS queries for the listed name servers, and maintain ingestion of updates from PhishDestroy and other blocklist providers. Investigators may also consider contacting the registrar (Trustname.com) for further intelligence. Ongoing observation of new detections on VirusTotal or related feeds is recommended to track changes in the threat posture.