io-fastswap[.]icu

This domain, io-fastswap.icu, is confirmed as a crypto drainer phishing site targeting decentralized finance (DeFi) users. Analysis indicates the site employs wallet-draining scripts to siphon cryptocurrency assets upon connection, a tactic commonly associated with malicious actors impersonating legitimate swap platforms. The page title 'Success!' suggests a deceptive confirmation mechanism designed to trick users into believing a transaction or interaction was completed, further facilitating unauthorized fund transfers. Infrastructure analysis reveals the domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on May 31, 2026, an anomalous creation date likely indicative of typosquatting or preemptive registration for malicious purposes. It resolves to IP address 188.114.97.3, a Cloudflare-protected endpoint leveraging HTTP/3 and Cloudflare Browser Insights, which may obscure backend infrastructure. The domain is flagged by 7 out of 95 security vendors on VirusTotal and appears on 3 security blocklists, including high-confidence threat intelligence feeds. Current detection status confirms it is blocked by wallet security extensions and phishing databases. As of the latest assessment, io-fastswap.icu has been taken offline, reducing immediate exposure risk. However, residual threats persist due to potential cached DNS records, browser history entries, or secondary distribution channels. Users who interacted with the domain are advised to revoke wallet permissions, monitor transaction histories for unauthorized activity, and verify connected applications. Organizations should update blocklists to include this domain and its associated IP, while remaining vigilant for similar typosquatting variants targeting DeFi platforms.