defiswiftpanel[.]web[.]app

Analysis of defiswiftpanel.web.app indicates this domain was actively involved in crypto-drainer phishing operations prior to being taken offline. The domain, registered through Google LLC, resolved to 199.36.158.100 (US-based AS54113, Fastly, Inc.) and was served via Firebase infrastructure with HSTS and HTTP/3 enabled. The SSL certificate, issued by Google Trust Services (WR4), remains valid, though the site now returns an HTTP 404 status, suggesting removal or takedown of malicious content. Detection data reveals the domain appeared on at least one security blocklist and was flagged by PhishDestroy.

Scamadviser assigned a trust score of 1 out of 100, further supporting its classification as a crypto scam. VirusTotal results from July 2026 show three security vendors flagged the domain, though the specific detection logic remains unconfirmed. The page title, 'Welcome to our website,' provides no additional brand or service context, leaving the exact targeting mechanism unclear. Infrastructure analysis confirms the domain used Google Cloud nameservers (ns-cloud.googledomains.com), aligning with Firebase hosting patterns.

While the site is currently offline, defenders should treat any prior interactions with this domain as high-risk, particularly for wallet-draining attacks. Historical DNS records and SSL certificate transparency logs may contain residual indicators for retrospective hunting. No evidence suggests persistence or active command-and-control infrastructure, but monitoring for re-registration or DNS reactivation is recommended.