lovelyswap[.]pages[.]dev

PhishDestroy identifies lovelyswap.pages.dev as an active credential theft domain masquerading under the guise of a crypto-related initiative called ProjectDatabaseServer. The domain was flagged by 2 of 95 VirusTotal vendors at the time of analysis, indicating that signature-based defenses have yet to catch up to this threat. It is registered through Cloudflare, Inc., resolves to IP address 172.66.44.238, and operates with a Google Trust Services SSL certificate. As of the latest scan, the domain remains live and responsive, offering no immediate blocklist entries or reputation-based detections. The page title ProjectDatabaseServer suggests an attempt to imitate legitimate database or backend infrastructure tools commonly used in cryptocurrency or DeFi ecosystems, potentially luring users into entering sensitive login or wallet connection credentials. Risk assessment places this domain under investigation due to its active status and low detection rate, despite the absence of current blocklist flags. The combination of Cloudflare hosting, a reputable certificate issuer, and sophisticated naming conventions indicates an advanced evasion strategy aimed at bypassing traditional security measures. While no known brand impersonation has been confirmed at this stage, the naming and setup strongly resemble techniques used by credential theft actors targeting crypto users. Security analysts are advised to block traffic to lovelyswap.pages.dev immediately at network and endpoint levels. Users should verify URLs via official channels before interacting with any crypto-related websites, especially those hosted on pages.dev or using Cloudflare services. Implementing browser-level filtering and DNS sinkholing against 172.66.44.238 is recommended to prevent accidental access. Continuous monitoring and threat intelligence sharing are advised as this domain evolves and new detection indicators emerge.