chimpyswap[.]io

This domain, chimpyswap.io, is identified as a brand impersonation phishing site targeting users of the Across cryptocurrency platform. The site mimics a legitimate cryptocurrency exchange, presenting itself under the page title 'Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | CHIMPYSWAP.' Analysis indicates the domain is designed to deceive users into engaging with fraudulent exchange services, potentially leading to unauthorized asset transfers or credential harvesting. No specific drainer kit signatures were observed in initial scans, but the impersonation of a known crypto brand suggests a high likelihood of malicious intent tied to financial fraud. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 17 out of 95 security vendors on VirusTotal, indicating broad detection across multiple threat intelligence sources. It was registered through NiceNIC International Group Co., Limited on February 21, 2026, and resolves to the IP address 172.67.135.74, hosted on Cloudflare’s network (AS13335). The domain currently lacks an SSL certificate, a red flag for user security. It appears on one security blocklist, and no entries were found in Google Safe Browsing at the time of assessment. The creation date suggests the domain was established specifically for malicious purposes, given its alignment with recent phishing campaigns targeting cryptocurrency users. As of the latest verification, chimpyswap.io has been taken offline, likely due to enforcement actions by hosting providers or security teams. However, the remaining risk persists due to the domain’s recent registration and the potential for threat actors to re-establish infrastructure under similar naming conventions. Users and organizations are advised to monitor for re-emergence of this domain or related variants, particularly those impersonating Across or other decentralized finance platforms. Blocking the IP address 172.67.135.74 and domains registered via NiceNIC with similar characteristics is recommended as a proactive defense measure. Cryptocurrency users should verify exchange URLs through official sources and enable multi-factor authentication to mitigate credential theft risks.