dayproswap[.]live

PhishDestroy identifies dayproswap.live as an active crypto drainer phishing domain currently under investigation. The domain masquerades as a cryptocurrency trading platform to deceive users into connecting wallets and approving malicious token transfers. This threat exploits trust in legitimate swap interfaces to execute unauthorized fund extraction through smart contract approvals. The investigation remains ongoing as analysts evaluate the scope of impersonated services and potential victim impact.

This domain was flagged by 3 of 95 VirusTotal vendors as of seed 645393, indicating undetected malicious activity. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 11, 2026, the domain resolves to IP address 188.114.97.3. The SSL certificate issued by Let's Encrypt suggests an attempt to appear legitimate, while the absence of VirusTotal detections highlights evasion of signature-based detection systems. Further, the domain has not been identified on any known public blocklists at this time, presenting elevated risk due to lack of preventative coverage.

The current status remains active with a risk level under investigation. Given the crypto drainer threat model, users are strongly advised to block access to dayproswap.live at the network and endpoint levels. Security teams should inspect DNS logs for queries to this domain and monitor for wallet approval transactions to suspicious contracts. Implementing network-level blocks via firewall rules or DNS sinkholing is recommended to prevent user interaction. Additionally, users should verify swap platforms via official websites and avoid clicking unverified links in social media or messaging channels. Continuous monitoring is advised as this domain may escalate in detection coverage or expand in malicious functionality.