paraswap[.]cc

This domain, paraswap.cc, is confirmed to operate as a DeFi credential harvesting site designed to steal cryptocurrency wallet credentials. Analysis indicates the site employs interface spoofing techniques to mimic legitimate decentralized exchange platforms, tricking users into entering sensitive wallet recovery phrases, private keys, or signing malicious transactions. The threat specifically targets users of browser-based and mobile cryptocurrency wallets, leveraging social engineering to exploit trust in well-known DeFi protocols. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on January 13, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with fraudulent domains. It appears on four security blocklists and is flagged by 5 out of 95 security vendors on VirusTotal, including detections for phishing and credential theft. The domain resolves to the IP address 5.255.119.131, which has been linked to other confirmed phishing campaigns targeting cryptocurrency users. The page title, FASTPANEL, suggests the use of a commercial hosting control panel, a common infrastructure choice for low-cost phishing deployments. Users who visited paraswap.cc or interacted with its content should take immediate action to mitigate risk. Any entered credentials, recovery phrases, or private keys must be considered compromised and should never be reused. Affected users should transfer assets to a new wallet with a fresh seed phrase and monitor all connected accounts for unauthorized transactions. Browser extensions and applications that may have cached credentials should be reviewed and cleared. Network-level indicators, such as the domain and resolving IP, should be added to local blocklists to prevent future exposure. Organizations should update internal threat intelligence feeds to include this domain and its associated infrastructure for proactive defense.