kyberswap-swap[.]pages[.]dev

The domain kyberswap-swap.pages.dev has been identified as a high-risk brand impersonation site, currently active, targeting the cryptocurrency platform KyberSwap. This site poses a significant threat by attempting to deceive users into believing they are interacting with the legitimate KyberSwap service.

Analysis indicates that the domain is flagged by 1 of 95 VirusTotal vendors, suggesting a low but notable level of detection. The domain is registered through Cloudflare, Inc., and resolves to the IP address 172.66.44.167, which is located in the United States and is part of the Cloudflare, Inc. network (AS13335). The SSL certificate is issued by Google Trust Services / WE1, adding a layer of perceived legitimacy. The domain was created on August 15, 2024, and is currently listed on 2 security blocklists: PhishDestroy and ScamSniffer. These indicators point to a sophisticated attempt to impersonate the brand and potentially harvest sensitive user information or deploy malicious activities.

Given the current active status of the domain, it is crucial for users to exercise caution and avoid interacting with this site. Security researchers and organizations are advised to monitor the domain for any changes in threat level and to implement appropriate network-level blocking measures. Users should verify the authenticity of any KyberSwap-related links by accessing the official KyberSwap website directly and reporting any suspicious activities to the platform's support team.