faq-sunswaap-en-us[.]pages[.]dev

This domain, faq-sunswaap-en-us.pages.dev, is flagged as a high-risk crypto phishing resource actively impersonating Sunswap, a decentralized exchange platform. The site presents itself as a legitimate support or trading portal under the guise of "Sunswap — Fast, Simple, Solar-Powered Decentralized Swap," aiming to deceive users into disclosing wallet credentials, private keys, or authorizing fraudulent transactions. Current status remains active, with no takedown observed as of the latest verification cycle (seed db008b).

Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. and resolves to IP address 172.66.44.164, geolocated to a Cloudflare node in California. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging Cloudflare Pages. The domain was created on April 22, 2026, indicating recent deployment likely timed to exploit current user interest in decentralized finance (DeFi) platforms. Detection metrics show 3 of 95 security vendors on VirusTotal have flagged the domain, while it appears on one additional security blocklist. The low initial detection rate suggests either evasion tactics or limited exposure at the time of assessment.

Risk assessment indicates a high potential for financial loss due to the domain's targeted impersonation of a known DeFi service. Users are advised to immediately block access to this domain across all endpoints and network gateways. Security teams should add 172.66.44.164 and faq-sunswaap-en-us.pages.dev to internal denylists and monitor for related subdomains or IP reuse. Wallet providers and DeFi platforms are recommended to issue warnings to users about this active impersonation campaign. Continuous monitoring of Cloudflare Pages-hosted domains with similar naming patterns (e.g., brand + faq/en-us + pages.dev) is advised to detect follow-on threats.