goblinswap[.]io

This domain operates as a crypto drainer phishing site targeting users of decentralized finance platforms. Analysis indicates it mimics legitimate swap services to trick victims into connecting wallets, enabling unauthorized transactions that drain cryptocurrency holdings. The site employs social engineering tactics, including fake token swaps and yield farming offers, to exploit users seeking quick returns on digital assets. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with phishing operations. VirusTotal reports 6 out of 95 security vendors flagging the domain as malicious, while it appears on 3 independent security blocklists. The site resolves to IP address 188.114.97.3 and uses Cloudflare services, including HTTP/3 and Browser Insights, to obscure its true origin and evade detection. Users who interacted with goblinswap.io should immediately revoke any connected wallet permissions and transfer remaining assets to a new secure wallet. Monitor transaction history for unauthorized transfers and report any suspicious activity to relevant blockchain explorers. Consider implementing additional security measures such as hardware wallets and multi-factor authentication for future transactions. The domain's current offline status does not eliminate the risk to previously exposed credentials or wallet connections.