dotswap-dex[.]com

This domain is flagged as a high-risk phishing threat specifically designed to impersonate DotSwap, a decentralized exchange operating on Polkadot and TRON networks. Analysis indicates the site employs deceptive branding to mimic legitimate DEX platforms, likely aiming to harvest cryptocurrency wallet credentials or distribute malicious smart contracts. The threat type is classified as a generic phishing attack with cryptocurrency-specific targeting, posing significant financial risk to users who interact with its interface or connect wallets to the platform. Infrastructure analysis reveals multiple red flags corroborating the malicious classification. The domain was registered on April 14, 2026, through GoDaddy.com, LLC, with an unusually future creation date suggesting possible typosquatting or preemptive registration for fraudulent purposes. It resolves to the IP address 186.2.175.35 and employs DDoS-Guard for protection, a service frequently associated with illicit online operations. Security vendors on VirusTotal flagged the domain at a rate of 18/95, while it appears on four distinct security blocklists and is actively blocked by cryptocurrency wallet providers and phishing detection systems. The SSL certificate is issued by Let's Encrypt, providing basic encryption but no legitimacy assurance. Detected technologies include Modernizr, a JavaScript library commonly used in both legitimate and malicious web applications. Mitigation against this threat requires a multi-layered approach tailored to cryptocurrency phishing. Users should verify domain registration dates through WHOIS lookups, cross-referencing with official project documentation for legitimate platform domains. Wallet providers are advised to maintain updated blocklists incorporating this domain and its associated IP address. Network-level protections should include DNS filtering to prevent resolution of the domain and its subdomains. Cryptocurrency projects should proactively monitor for impersonation attempts, particularly those leveraging future-dated domain registrations or DDoS protection services with questionable reputations. Security teams should analyze the domain's historical content if available, focusing on wallet connection prompts and smart contract interaction patterns to identify specific attack vectors employed.