start-io-sunswp-v2[.]pages[.]dev

This domain, start-io-sunswp-v2.pages.dev, is flagged as a high-risk phishing site targeting cryptocurrency users through brand impersonation. Analysis indicates it mimics Sunswap v2, a decentralized exchange, by displaying the page title 'Sunswap v2 – Next-Level Decentralized Exchange with Low Fees.' The site likely operates as a crypto drainer, tricking users into connecting wallets to steal funds or credentials. No specific drainer kit signatures have been confirmed, but the domain’s structure and branding align with known phishing tactics in the decentralized finance (DeFi) space.

Technical indicators reveal the domain was registered through Cloudflare, Inc. on May 3, 2026, an anomalous future date suggesting potential obfuscation. It resolves to the IP address 172.66.44.123, hosted in Canada under Cloudflare’s infrastructure. VirusTotal detection shows 1 out of 95 security vendors flagging the domain, while Google Safe Browsing (GSB) status remains unconfirmed. The domain appears on one security blocklist and is actively blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious Cloudflare-hosted sites.

As of the latest verification, start-io-sunswp-v2.pages.dev remains active and unresolved. No takedown actions have been observed, and the domain continues to serve phishing content. Users are advised to avoid interaction, block the domain at the network level, and verify decentralized exchange URLs through official sources. The remaining risk is high due to the domain’s active status, targeted impersonation of a DeFi platform, and minimal detection coverage, which may allow it to evade some security filters.