swap[.]stage-copr-qtech[.]site

This domain, swap.stage-copr-qtech.site, is identified as a high-risk cryptocurrency drainer operation impersonating the legitimate UexSwap platform. Analysis of the page title, 'UexSwap | Instant Cryptocurrency Exchange | Best rates,' and the detected technologies, including WebAssembly and Stripe integration, suggests the deployment of a crypto wallet-draining kit designed to siphon digital assets from unsuspecting users. The domain mimics the branding and functionality of a legitimate cryptocurrency exchange, leveraging social engineering tactics to deceive victims into connecting their wallets to malicious smart contracts or fake exchange interfaces.

Technical indicators confirm the malicious nature of this domain. The domain was registered through Go Daddy, LLC on February 21, 2026, an anomalous creation date likely intended to evade initial scrutiny. It resolves to the IP address 104.21.12.161 and is flagged by Google Safe Browsing for 'SOCIAL_ENGINEERING.' The domain appears on two security blocklists and is detected by 14 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services, which, while not inherently malicious, is commonly exploited by threat actors to lend an appearance of legitimacy to fraudulent domains.

As of the latest assessment, swap.stage-copr-qtech.site has been taken offline, likely in response to its detection by multiple security platforms, including PhishDestroy and OISD. However, the infrastructure and tactics observed indicate a persistent threat. Users who may have interacted with this domain are advised to immediately revoke any connected wallet permissions, transfer remaining assets to a secure wallet, and monitor for unauthorized transactions. Organizations should update their blocklists to include this domain and its associated IP address to prevent future access attempts. The use of WebAssembly and other advanced technologies in this campaign underscores the evolving sophistication of cryptocurrency drainers, necessitating heightened vigilance among users and security teams.