swell-mainnet[.]pages[.]dev

This domain, swell-mainnet.pages.dev, is actively impersonating Swell Network’s legitimate UI Explorer interface to conduct cryptocurrency phishing attacks. Analysis indicates the site mimics the appearance and functionality of Swell Network’s staking and node management portal, likely targeting users attempting to interact with the protocol’s mainnet. The objective appears to be credential harvesting, private key theft, or direct wallet drainage through fraudulent transaction prompts, a common tactic in decentralized finance (DeFi) phishing campaigns. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.44, geolocated in the United States under AS13335 (Cloudflare, Inc.). The domain is flagged by 6 out of 95 security vendors on VirusTotal, and appears on two independent security blocklists. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider, which may lend a false sense of security to unsuspecting users. Despite its recent creation date, the domain remains active and unmitigated at the time of this report. Users who have visited swell-mainnet.pages.dev or interacted with its content should immediately revoke any connected wallet permissions and cease all engagement with the site. If credentials or private keys were entered, affected wallets should be considered compromised, and funds transferred to a new, secure wallet. Monitor transaction histories for unauthorized activity and report the domain to relevant security teams or blocklist providers. Organizations should update web filters to block the domain and its resolving IP address, and consider deploying indicators of compromise (IOCs) such as the domain, IP, and SSL certificate thumbprint for proactive detection.