thewordbar[.]com

PhishDestroy identifies thewordbar.com as a live crypto-draining phishing site that quietly swaps wallet addresses on every transaction to steal your coins. In plain words, if you visit this page and connect your wallet to participate in any “airdrop,” “giveaway,” or “token swap,” the site automatically replaces your real wallet address with an attacker-controlled one. As soon as you approve the transaction, your tokens vanish into wallets monitored by cybercriminals. We know this site is malicious because it was created only 12 days ago (March 10, 2023), registered through GoDaddy.com, LLC, and already 1 out of 95 leading security vendors on VirusTotal has flagged it. The domain resolves to IP 216.150.1.1 and holds a Let’s Encrypt certificate—both red flags when combined with its short lifespan and the absence of any legitimate business footprint. If you have already visited thewordbar.com, disconnect your wallet immediately. Revoke any token approvals via your wallet’s settings page, do not sign any further transactions, and run a full malware scan on the device you used. Then report the domain to PhishDestroy so others can be warned and our threat intelligence can disable it faster.