quickswap[.]trade

The domain quickswap.trade was observed on 12 July 2026 as an active infrastructure used for credential harvesting. The site is classified as a generic phishing operation and assigned a high risk rating by the reporting system. Infrastructure analysis shows that quickswap.trade was registered on 18 May 2026 through Amazon Registrar, Inc. The domain resolves to the IPv4 address 187.77.66.108, which is hosted in Germany by a provider identified as Hostinger DE. Four Amazon Route 53 name servers (ns-1315.awsdns-36.org, ns-1916.awsdns-47.co.uk, ns-668.awsdns-19.net, and an additional entry) serve the zone, and TLS termination is provided by a certificate issued by Google Trust Services under the WE1 profile. The HTTP response issued by the server is a 301 redirect. Threat intelligence sources corroborate the malicious intent. VirusTotal records indicate that four out of ninety‑five security scanners flagged the domain as malicious. The domain appears on three independent security blocklists and is referenced in a single AlienVault OTX pulse, reinforcing the high‑risk assessment. Visible content is limited to a browser title reading “Just a moment…”, suggesting that the landing page may be dynamically generated or serve a short‑lived loading screen before delivering credential‑stealing forms. No additional payload or phishing kit has been publicly captured, leaving the exact lure and target brand ambiguous. Defenders should proactively block quickswap.trade at DNS and network layers, monitor DNS queries for the associated name servers, and flag any outbound connections to 187.77.66.108. Continuous re‑inspection of the domain’s TLS certificate and HTTP redirects is advisable, as changes may indicate escalation. Users should be warned that any unsolicited request to authenticate or provide wallet credentials on this domain is likely fraudulent.