unisocks-swap[.]xyz

This domain, unisocks-swap.xyz, is flagged as a high-risk cryptocurrency phishing site designed to harvest wallet credentials and private keys. Analysis indicates the domain mimics legitimate decentralized exchange (DEX) interfaces, likely targeting users of Uniswap or similar platforms through fake swap or liquidity provision prompts. No specific drainer kit signatures have been confirmed, but the infrastructure aligns with known phishing campaigns impersonating blockchain services.

Technical indicators reveal the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, an uncommon registrar for legitimate crypto projects. It resolves to IP address 172.67.197.96, hosted on AS13335 (Cloudflare, Inc.), a common proxy for malicious sites. VirusTotal reports 3/95 security vendors detecting the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of legitimacy. Google Safe Browsing (GSB) currently labels the page as a 'Suspected phishing site.'

As of the latest assessment, unisocks-swap.xyz remains active and unblocked by most security providers, posing a persistent risk to users. Immediate response actions include blacklisting the domain in enterprise security gateways, updating endpoint protection rules to flag the IP and SSL certificate thumbprint, and notifying affected user groups. Despite Cloudflare's proxy, historical DNS records may reveal additional infrastructure. The domain's future takedown depends on registrar enforcement, but its recent creation date suggests it may evade detection for weeks. Users are advised to verify DEX interfaces via official documentation and avoid interacting with any site requesting wallet connections or private key inputs.