auth-defillama-swaap-io-us[.]pages[.]dev

On July 25, 2026, the domain auth-defillama-swaap-io-us.pages.dev was observed as a high‑risk crypto drainer that has been taken offline. The domain was created on February 21, 2026 and is registered through Cloudflare, Inc. DNS resolution points to the IP address 172.66.47.204, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. HTTP requests to the host return a 403 status code, and the page title presented by Cloudflare is "Suspected phishing site | Cloudflare," indicating that the service has flagged the content as malicious. Google Safe Browsing classifies the URL under social engineering, reinforcing the phishing‑related nature of the site.

The domain appears on a single security blocklist, specifically PhishDestroy, and receives a Gridinsoft trust score of 0 out of 100, reflecting a lack of confidence in its legitimacy. The SSL certificate in use is issued by Google Trust Services under the WE1 designation, a common certificate for Cloudflare‑protected sites, but does not mitigate the malicious intent. VirusTotal analysis shows that 13 of 93 scanned security vendors flagged the domain, providing additional corroboration of its threat profile. Technical observations note the presence of HTTP/3, HSTS, and Cloudflare infrastructure, while the authoritative name servers are zeus.ns.cloudflare.com and brenda.ns.cloudflare.com.

While the site is currently offline, the combination of a recent creation date, Cloudflare‑hosted infrastructure, a low trust score, and multiple vendor detections suggests a deliberate attempt to lure victims into a cryptocurrency‑draining scheme. Defenders should continue to block the domain at perimeter filters, monitor for any re‑registration attempts, and correlate outbound traffic to the associated IP address with potential compromise indicators. Ongoing vigilance is advised, especially for users who may have previously accessed the domain before its takedown.