swaprhq[.]io

This domain, swaprhq.io, is identified as a generic phishing site targeting users of decentralized finance (DeFi) platforms. Analysis of the page title, 'Swapr - Building next-generation DeFi products,' indicates an attempt to impersonate a legitimate DeFi service, likely aiming to deceive users into disclosing wallet credentials or authorizing malicious transactions. No specific drainer kit signatures were observed in the available data, but the domain’s structure and branding align with common cryptocurrency phishing tactics. Infrastructure analysis reveals the domain was registered on February 21, 2026, through an undisclosed registrar, an unusually future-dated creation that may indicate an attempt to evade detection or correlation with other campaigns. It resolves to the IP address 76.76.21.164, hosted on AS16509 (Amazon.com, Inc.) in the United States. The domain is flagged by 9 out of 95 security vendors on VirusTotal, and it appears on one security blocklist. The SSL certificate is issued by Let's Encrypt (R13), a common tactic to lend false credibility to phishing sites. Google Safe Browsing (GSB) status is not explicitly listed, but the domain’s presence on a single blocklist suggests limited but targeted detection. As of the latest assessment, swaprhq.io has been taken offline, likely in response to detection and reporting. However, the elevated risk level persists due to the domain’s recent creation date and the potential for infrastructure reuse. Users who interacted with the domain prior to its takedown should immediately revoke any wallet authorizations, monitor for unauthorized transactions, and verify the legitimacy of any connected DeFi platforms. Organizations are advised to block the domain and its associated IP address (76.76.21.164) at the network level to prevent further exposure.