transitswap[.]finance

This domain, transitswap.finance, is actively targeting cryptocurrency users with a crypto wallet drainer phishing scheme. Analysis indicates the site mimics legitimate Web3 connection interfaces, tricking victims into authorizing malicious smart contracts that siphon digital assets from connected wallets. The threat specifically exploits the Web3 Connect Demo page title, suggesting an attempt to deceive users into granting transaction permissions under false pretenses, leading to immediate and irreversible asset loss. Technical evidence supports the malicious classification. The domain was registered on December 02, 2025, through Dynadot Inc, and currently resolves to IP address 104.21.23.22 hosted on Amazon.com, Inc. (AS16509). Despite zero detections on VirusTotal (0/95), the domain appears on one security blocklist (PhishDestroy). The SSL certificate is issued by Let's Encrypt (YR1), a common tactic to lend false legitimacy to phishing infrastructure. The creation date, combined with the lack of historical reputation, aligns with patterns observed in short-lived, high-impact crypto drainer campaigns. Users who have interacted with transitswap.finance should immediately revoke any connected wallet permissions via their wallet's dApp connection manager. All active sessions should be terminated, and a full security audit of the wallet's transaction history is recommended to identify unauthorized transfers. If assets were transferred, report the incident to relevant blockchain explorers and law enforcement cybercrime units. Avoid reusing credentials or wallet addresses associated with this domain, as they may be targeted in follow-up attacks. Monitor for unusual smart contract interactions or pending transaction approvals, which could indicate ongoing compromise.