swift-firechain[.]xyz

This domain is flagged as a high-risk crypto drainer, a threat type designed to automatically siphon cryptocurrency from connected wallets. Analysis indicates malicious infrastructure configured to exploit users through deceptive transaction prompts or fake token approvals, typical of wallet-draining schemes. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain swift-firechain.xyz resolves to IP 104.168.69.100 (AS36352, HostPapa US), and was registered on August 17, 2025, through Web Commerce Communications Ltd. Security vendors on VirusTotal flagged the domain 11/95 times, while it appears on four blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. The SSL certificate is classified as R11, a low-trust indicator often associated with ephemeral phishing sites. The page title '421 Misdirected Request' suggests misconfigured or intentionally obfuscated server responses, a common tactic to evade automated detection. Mitigation requires immediate action to prevent financial loss. Users should revoke any token approvals granted to swift-firechain.xyz via wallet interfaces like Etherscan or blockchain explorers. If the domain was previously visited, disconnect all wallet connections and audit transaction histories for unauthorized transfers. Browser-based extensions or security tools that block known malicious domains should be updated to include this indicator. Organizations should add swift-firechain.xyz and its resolving IP to network-level deny lists to prevent internal access. Given the domain's recent registration and offline status, monitor for re-emergence under similar naming conventions or IP ranges.