unisocks-swap[.]com

This domain, unisocks-swap.com, is actively flagged as a cryptocurrency wallet phishing site. Analysis indicates it operates as a high-risk threat designed to harvest login credentials, private keys, or other sensitive financial data from unsuspecting users. The domain remains active and continues to host malicious content targeting cryptocurrency holders. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on February 21, 2026, an unusually future-dated creation that may indicate fraudulent registration practices. It resolves to the IP address 172.67.150.30, hosted on AS13335 Cloudflare, Inc. in the United States. The domain is flagged by 10 of 95 security vendors on VirusTotal, with detection names including generic phishing and cryptocurrency scam classifications. Additionally, it appears on three security blocklists, including PhishDestroy and MetaMask's internal threat intelligence feeds. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing sites frequently leverage valid certificates to appear legitimate. Current status confirms the domain remains active and poses an ongoing threat to users. Organizations and individuals are advised to block the domain and its associated IP address (172.67.150.30) at the network perimeter. Endpoint protection solutions should be updated to include this domain in deny lists. Users who may have interacted with the site should immediately revoke any exposed credentials, monitor accounts for unauthorized transactions, and consider resetting private keys if cryptocurrency wallets were accessed. Security teams are encouraged to review logs for connections to this domain and investigate potential compromise indicators.