b1tswaper[.]icu

This domain, b1tswaper.icu, operates as a fraudulent cryptocurrency conversion platform targeting users of USDT (Tether) stablecoin. The site presents itself as 'BitSwaper24,' offering fake USDT-to-fiat exchange services with a Russian-language interface ('Конвертация ЮСДТ'). Analysis indicates the site is designed to harvest login credentials, wallet addresses, and private keys under the guise of legitimate currency conversion. The inclusion of Google Analytics and Cloudflare technologies suggests an attempt to mimic professional financial services while concealing malicious intent behind standard web infrastructure. Infrastructure analysis reveals several critical indicators. The domain was registered on April 25, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.70.197, which is proxied through Cloudflare, obscuring the true origin of the hosting infrastructure. Despite its deceptive design, the domain currently shows 0 detections out of 95 security engines on VirusTotal, indicating it has not yet been widely flagged by automated scanning systems. The site appears on only one security blocklist, suggesting limited prior detection or reporting. Users who have visited b1tswaper.icu should take immediate action to mitigate potential compromise. First, disconnect any cryptocurrency wallets or accounts linked to the site and revoke any associated API permissions. Monitor all connected financial accounts for unauthorized transactions, particularly those involving USDT or other stablecoins. If login credentials were entered, change passwords on all platforms where similar credentials may have been reused. Given the domain's use of Let's Encrypt SSL certificates, users should not assume HTTPS connections guarantee legitimacy. Report the domain to relevant cryptocurrency security teams and consider submitting samples to threat intelligence platforms to improve detection rates.