pumpswapv2[.]fun

This domain, pumpswapv2.fun, is confirmed as a crypto drainer phishing site designed to exploit users engaging in cryptocurrency token swaps. Analysis indicates the site mimics legitimate decentralized exchange platforms to trick victims into connecting wallets, enabling unauthorized token transfers. The domain is currently offline, but its infrastructure and historical activity warrant continued monitoring. Infrastructure analysis reveals the domain was registered on January 02, 2026, through Name.com, Inc., and resolves to the IP address 216.198.79.1. It is flagged by 5 of 95 security vendors on VirusTotal and appears on 3 security blocklists, including MetaMask and PhishDestroy. The site employs a Let's Encrypt SSL certificate and uses Vercel for hosting, with HSTS enabled, likely to enhance the appearance of legitimacy. A Gridinsoft trust score of 0/100 and inclusion in 2 AlienVault OTX threat intelligence pulses further corroborate its malicious nature. The page title, 'PumpSwap v2 - Crypto Token Swap,' aligns with tactics used to impersonate legitimate DeFi platforms. The domain is currently offline, but its prior activity and technical indicators suggest a high likelihood of reemergence under a similar or altered infrastructure. Organizations and individuals are advised to block the domain and its associated IP address at the network level. Users who may have interacted with the site should immediately revoke any connected wallet permissions and monitor their accounts for unauthorized transactions. Security teams are encouraged to correlate these indicators with internal logs to identify potential compromises and update detection rules to include this domain and its infrastructure.