unisocks-dapp[.]xyz

This domain, unisocks-dapp.xyz, operates as a cryptocurrency drainer phishing site designed to deceive users into connecting their digital wallets. Once connected, the site executes unauthorized transactions, siphoning funds directly from the victim’s wallet without consent. The threat targets users of decentralized finance (DeFi) platforms, particularly those familiar with Uniswap or similar services, by mimicking legitimate decentralized application (dApp) interfaces. The primary objective is financial theft, with attackers leveraging social engineering tactics to exploit trust in blockchain-based interactions. Analysis indicates the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious infrastructure. The site is flagged by 3 out of 95 security vendors on VirusTotal, a relatively low detection rate that suggests either evasion techniques or recent deployment. It resolves to the IP address 172.67.176.206, hosted on Cloudflare’s network (AS13335), which provides anonymity and resilience against takedowns. The SSL certificate, issued by Google Trust Services (WE1), further obscures the site’s malicious intent by presenting a seemingly secure connection. The domain appears on one security blocklist, specifically PhishDestroy, and remains active as of this report. Users who have visited unisocks-dapp.xyz or interacted with its content should immediately disconnect any connected wallets from the site. Revoke all active smart contract approvals using a blockchain explorer or a dedicated wallet security tool to prevent further unauthorized transactions. Monitor wallet activity for unfamiliar transactions and transfer remaining funds to a new, secure wallet. Report the incident to relevant platforms, such as the wallet provider or cryptocurrency exchange, to alert them of potential compromise. Enable multi-factor authentication on all accounts and consider using hardware wallets for enhanced security. Regularly audit connected dApps and revoke permissions for any unused or suspicious services.