lichen-network-dex[.]pages[.]dev

The domain lichen-network-dex.pages.dev was registered on March 28, 2026 through Cloudflare, Inc. It resolves to the IP address 172.66.47.141, which is hosted in the Cloudflare network (CA). The authoritative nameservers are corey.ns.cloudflare.com and joselyn.ns.cloudflare.com. TLS is provided by a Let’s Encrypt certificate (CN=E8) and the site enforces HTTP Strict Transport Security. Detected front‑end components include cdnjs libraries, Cloudflare edge services, and HTTP/3 support. The page title returned by the server is “Lichen DEX — Agent-First Decentralized Exchange”, indicating a fake exchange front‑end. The site returned HTTP 200 and is currently listed on one security blocklist; PhishDestroy has already added it to its block list, yet the domain remains active. Gridinsoft assigned a trust score of 0 / 100, and VirusTotal scans by 94 vendors reported no detections, a neutral indicator that does not confirm safety. The classification in the intelligence set is “Fake Exchange” under the generic_phishing threat type, with a risk level marked under_investigation. No additional forensic artifacts (e.g., malicious scripts, credential‑stealing forms) have been disclosed. Defenders should block the domain at network perimeter and DNS layers, monitor for any outbound connections to the resolved IP, and continue to track changes to its TLS configuration or content. Given the recent registration date and the presence of a legitimate‑looking exchange title, the site likely aims to harvest credentials or funds from users seeking decentralized finance services. Ongoing observation is advised to detect possible evolution of the payload or the appearance of associated infrastructure.