io-svvap[.]com

This domain, io-svvap.com, is assessed as an elevated-risk phishing site specifically designed to function as a crypto wallet drainer. Analysis indicates the infrastructure is engineered to mimic legitimate wallet interfaces, tricking users into connecting their wallets and authorizing malicious transactions that siphon funds to attacker-controlled addresses. The threat type aligns with a growing trend of crypto-focused phishing, where adversaries exploit social engineering and spoofed interfaces to compromise digital assets. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on March 29, 2026, through CNOBIN INFORMATION TECHNOLOGY LIMITED, a registrar frequently associated with fraudulent registrations. It resolves to the IP address 34.196.13.28, which has been linked to prior phishing campaigns. Detection metrics further corroborate the threat: VirusTotal reports 5 out of 95 security vendors flagging the domain, while three independent security blocklists have listed it as malicious. Additional trust assessments assign a score of 0 out of 100, reflecting no legitimate use cases. The domain is actively blocked by multiple security layers, including wallet protection mechanisms and anti-phishing tools. To mitigate exposure to this threat, users should immediately revoke any wallet connections associated with io-svvap.com and audit their transaction history for unauthorized transfers. Wallet software should be updated to the latest version, and browser-based security extensions should be enabled to block known phishing domains. Organizations managing crypto assets are advised to implement strict allowlisting policies for wallet interactions and deploy network-level filtering to prevent resolution of domains registered through high-risk registrars. Given the domain's current offline status, monitoring for re-emergence under similar naming conventions or infrastructure is recommended.