swtch[.]claims

The domain swtch.claims is a malicious website designed to steal cryptocurrency. It operates as a crypto drainer, meaning it tricks visitors into connecting their digital wallets and then drains their funds. This type of threat is particularly dangerous because it can empty a wallet in seconds without the user realizing until it's too late. The site poses a high risk to anyone holding cryptocurrency, as it mimics legitimate platforms to gain trust.

PhishDestroy's analysis reveals several red flags. The domain was registered just recently on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar often associated with suspicious domains. Its SSL certificate is from Google Trust Services, which is legitimate, but that doesn't guarantee safety—many phishing sites use valid certificates. VirusTotal shows that 7 out of 95 security vendors flagged this domain as malicious, and it appears on one security blocklist. Additionally, it was found in one AlienVault OTX threat intelligence pulse. The site resolves to IP 188.114.96.3, which is linked to Cloudflare, a common service used to hide the true hosting location. Fortunately, the site is currently offline, but it could reappear under a different domain.

If you visited swtch.claims and connected your crypto wallet, take immediate action. Revoke any permissions granted to the site through your wallet settings or blockchain explorer tools. Transfer your funds to a new, secure wallet that hasn't been exposed. Change your passwords and enable two-factor authentication on all related accounts. Monitor your wallet for unauthorized transactions and consider using a hardware wallet for future security. If you didn't connect a wallet, you are likely safe, but it's wise to run a security scan on your device and avoid visiting suspicious links in the future.