tp-swap1[.]pages[.]dev

This domain, tp-swap1.pages.dev, operates as a crypto drainer targeting users of the legitimate Transit Swap platform. The site mimics the appearance and branding of Transit Swap, including the page title 'Transit - 闪兑,' to deceive victims into connecting their cryptocurrency wallets. Once connected, the site executes malicious scripts designed to drain funds from the victim's wallet without authorization. The threat primarily targets users seeking to swap or manage digital assets, exploiting trust in the Transit Swap brand to facilitate financial theft. Analysis indicates this domain is part of a coordinated malicious campaign. The domain was registered on March 22, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.102, hosted on Cloudflare's infrastructure in Canada. VirusTotal reports that 6 out of 95 security vendors have flagged this domain as malicious, while it also appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common practice among threat actors leveraging legitimate CDN services to evade detection. The domain remains active and continues to pose a high risk to unsuspecting users. If you have visited tp-swap1.pages.dev or interacted with the site, immediate action is required to mitigate potential losses. First, disconnect any wallets or accounts linked to the domain and revoke any suspicious smart contract approvals using a blockchain explorer or wallet management tool. Next, scan the affected device for malware using updated security software to ensure no additional payloads were delivered. Monitor connected wallet addresses for unauthorized transactions and consider transferring remaining funds to a new, secure wallet. Report the incident to relevant blockchain security platforms and law enforcement to aid in tracking and disrupting the malicious infrastructure.