safewallets[.]vip

The domain safewallets.vip was identified as a crypto drainer phishing site. The domain impersonates a legitimate cryptocurrency service, USwap, and is suspected of using a drainer kit to siphon cryptocurrency from unsuspecting users. This type of threat involves malicious actors tricking users into providing access to their cryptocurrency wallets, leading to potential financial loss and compromise of personal data.

Technical analysis reveals that safewallets.vip has a VirusTotal score of 11/95, indicating that 11 out of 95 security vendors flag this domain as malicious. The domain is registered through Dynadot Inc and resolves to the IP address 104.21.95.110. It was created on June 05, 2025, and has a Gridinsoft trust score of 0/100, which is the lowest possible score. The domain is currently listed on one security blocklist and is blocked by the PhishDestroy service, further confirming its malicious nature. The SSL certificate is issued by Let's Encrypt, and the site uses technologies such as Ant Design, React, and Cloudflare services, including Cloudflare Browser Insights and HTTP/3.

As of the latest assessment, safewallets.vip is offline, reducing the immediate risk to users. However, the domain's high VirusTotal score and its appearance on security blocklists indicate that it has been actively used for malicious activities. It is recommended to continue monitoring the domain for any signs of reactivation and to ensure that security measures are in place to prevent access to this and similar domains. Users should avoid clicking on links or entering credentials on any unrecognized cryptocurrency-related sites to mitigate the risk of falling victim to a crypto drainer attack.