smartwalletdefi[.]web[.]app

This domain, smartwalletdefi.web.app, is flagged as an active brand impersonation threat targeting users of Across Protocol, a cross-chain bridging platform. Analysis indicates the infrastructure is designed to deploy a crypto wallet drainer, tricking victims into connecting wallets to malicious smart contracts that execute unauthorized transactions, resulting in direct asset theft. The page title, Smart Wallet Defi, mimics legitimate decentralized finance interfaces to increase credibility and lower user suspicion. Infrastructure analysis reveals the following technical indicators: the domain is hosted on Google Firebase and resolves to IP address 199.36.158.100, geolocated in the United States under AS54113 (Fastly, Inc.). VirusTotal detection shows 10 out of 95 security vendors have flagged the domain as malicious. The domain appears on one security blocklist and is currently blocked by at least one threat intelligence feed. The SSL certificate is issued by Google Trust Services (WR4), a common certificate authority for both legitimate and malicious Firebase-hosted domains. No domain registration date is available due to Firebase's hosting model, which does not expose traditional WHOIS records. As of the latest verification, smartwalletdefi.web.app remains active and continues to pose a high risk to users. While the domain is blocked by some security feeds, it is not yet universally recognized, allowing potential exposure to unprotected users. Response actions should include immediate blacklisting in enterprise and consumer security tools, submission to additional threat intelligence platforms, and public disclosure to warn the cryptocurrency community. Users are advised to verify all DeFi interfaces via official project channels and avoid connecting wallets to untrusted domains, even if they appear visually legitimate. The use of hardware wallets and transaction simulation tools can provide additional layers of protection against unauthorized asset transfers.