defiswap[.]us

This domain, defiswap.us, was designed to trick cryptocurrency users into connecting their wallets, after which it would drain their funds. It posed as a legitimate DeFi platform, likely impersonating Uniswap given the name and page title 'The Best Crypto'. The threat is a crypto drainer, a type of malicious script that automatically transfers tokens from a victim's wallet once they authorize a transaction. Users who visited the site and connected their wallet may have lost assets.

PhishDestroy identified this threat through multiple indicators. VirusTotal flagged it with 2 out of 95 security vendors marking it as malicious. The domain was registered using a privacy service and hosted on Cloudflare, with an SSL certificate from Let's Encrypt (E8). It resolved to IP 172.67.178.194. The site is now offline, but it appeared on 3 security blocklists. The unique seed 5f2fec was used to track this analysis.

If you visited defiswap.us and connected your wallet, immediately revoke any token approvals using a tool like Etherscan's token approval checker or Revoke.cash. Do not interact with any transactions from this site. Monitor your wallet for unauthorized transfers and consider moving funds to a new wallet if you suspect compromise. Always verify URLs carefully and use hardware wallets or browser extensions that block known malicious domains.