app-thorswap-finance[.]pages[.]dev

The domain app-thorswap-finance.pages.dev was created on February 21, 2026 and is currently offline. Technical analysis shows it resolves to IP address 188.114.97.3, hosted within the Cloudflare network (AS13335, United States). Registration was performed through Cloudflare, Inc., and the site served a Google Trust Services / WE1 SSL certificate, indicating a valid TLS handshake. HTTP responses returned a 403 status code, and the page title reported by the server is "Suspected phishing site | Cloudflare".

The infrastructure utilizes Cloudflare services, including HSTS and HTTP/3, with authoritative nameservers daisy.ns.cloudflare.com and moura.ns.cloudflare.com. VirusTotal scans recorded two detections out of 93 security vendors, and the domain appears on a single security blocklist, where it has been listed by PhishDestroy. Independent trust assessments are low: Gridinsoft assigns a score of 0 / 100 and Scamadviser rates the domain at 41 / 100.

No additional intelligence such as Safe Browsing, OTX, or other blocklists was provided. Defenders should incorporate the IP 188.114.97.3 and the full domain name into network‑level denial lists, ensure that any user‑facing filters reference the Cloudflare‑hosted certificate fingerprint, and monitor for future re‑registration attempts that reuse similar sub‑domains or nameservers. Continuous enrichment of detection signatures with the observed vendor detections and blocklist entries is recommended, as is user awareness messaging that highlights the Thorchain brand impersonation associated with this domain.