quick-swap[.]co

The domain quick-swap.co has been identified as a brand impersonation phishing site, specifically targeting the Base blockchain ecosystem. The page title, "QuickSwap: The Leading DEX on Polygon and Base," was used to deceive users into believing they were interacting with a legitimate decentralized exchange. This type of attack typically aims to harvest credentials or private keys, and while no specific drainer kit was identified in the available intelligence, the domain was designed to appear as a trusted DeFi platform.

Technical indicators provide a clear picture of the threat. VirusTotal data shows 2 out of 95 security vendors flagged this domain, indicating moderate but significant detection. The domain was registered through Dynadot LLC on March 6, 2026, and resolves to IP address 188.114.96.3. It is currently listed on 3 security blocklists, though there is no mention of Google Safe Browsing status in the provided data. The SSL certificate was issued by Google Trust Services (WE1), which adds a layer of false legitimacy for unsuspecting visitors.

As of the latest assessment, quick-swap.co has been taken offline, reducing the immediate risk to users. However, the remaining threat lies in the potential for similar domains to appear or for the site to be reactivated. Users who may have interacted with this site should monitor their accounts and consider revoking any permissions granted. PhishDestroy recommends avoiding any unsolicited links to DEX platforms and always verifying domain authenticity through official channels. For further details, security professionals can access the full threat report for comprehensive analysis.