tarotswap[.]netlify[.]app

This domain, tarotswap.netlify.app, operates as a crypto drainer phishing site specifically targeting users of the decentralized exchange Uniswap. The site presents a fraudulent interface labeled 'Uniswap Interface' designed to trick visitors into connecting their cryptocurrency wallets. Once connected, the malicious smart contracts embedded in the site can automatically drain funds from the victim's wallet without further authorization, exploiting the trust associated with the legitimate Uniswap brand to execute unauthorized transactions. Analysis indicates this is a well-established phishing operation with multiple technical indicators confirming its malicious nature. The domain was registered through Netlify on March 12, 2026, and is currently hosted on Amazon Web Services infrastructure in Germany with IP address 3.57.26.135. Security vendors on VirusTotal have flagged this domain, with 17 out of 95 engines detecting malicious activity. The site appears on three security blocklists and is actively blocked by multiple wallet security providers. The SSL certificate, issued by DigiCert Inc, uses the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain, which while technically valid, is commonly associated with phishing infrastructure due to its widespread availability. Users who have visited tarotswap.netlify.app or interacted with its interface should take immediate action to secure their assets. First, disconnect any wallet connections made to this domain through wallet settings. Next, revoke all token approvals associated with the address using a trusted token approval revocation tool. Monitor all connected accounts for unauthorized transactions and consider transferring assets to a new wallet address if any suspicious activity is detected. Report the incident to relevant security teams and wallet providers to help prevent further exploitation. Due to the high-risk nature of crypto drainers, affected users should assume their wallet credentials may have been compromised and act accordingly to protect their digital assets.