easy-swap-usdc[.]pages[.]dev

This domain, easy-swap-usdc.pages.dev, is identified as a high-risk crypto drainer phishing site designed to steal cryptocurrency assets from victims. Crypto drainers operate by tricking users into connecting their digital wallets to malicious smart contracts, which then execute unauthorized transactions, siphoning funds without consent. The domain mimics legitimate decentralized exchange or token swap services, using convincing interfaces to deceive users into approving malicious transactions. Given its active status and targeting of cryptocurrency holders, interaction with this site poses a direct financial risk, particularly for users of USDC or other Ethereum-based tokens. Analysis indicates this domain was registered through Cloudflare on February 21, 2026, and remains operational despite being flagged by security systems. VirusTotal reports that 1 out of 95 security vendors have detected this domain as malicious, a low but significant indicator given the specialized nature of crypto drainers. The domain resolves to the IP address 172.66.46.242, associated with Cloudflare’s infrastructure (AS13335), and is currently listed on two security blocklists: PhishDestroy and Enkrypt. The SSL certificate is issued by Google Trust Services (WE1), which, while not inherently malicious, is commonly exploited by phishing sites to appear legitimate. The use of Cloudflare’s content delivery network further complicates takedown efforts, as it obscures the true hosting origin. If a user has visited easy-swap-usdc.pages.dev or interacted with its content, immediate action is required to mitigate potential losses. First, revoke any active wallet connections or token approvals granted to the site using a blockchain explorer or wallet management tool. Next, transfer remaining assets to a new, secure wallet address not previously exposed to the phishing domain. Monitor transaction history for unauthorized transfers and report any suspicious activity to the relevant blockchain network’s fraud detection services. Users should also scan their devices for malware, as some crypto drainers deploy additional payloads to harvest credentials or private keys. Finally, avoid reusing passwords or wallet addresses associated with the compromised interaction, as attackers may attempt follow-up exploitation.