# merlinswap-6ib.pages.dev — SUSPICIOUS

> PhishDestroy flags merlinswap-6ib.pages.dev as a crypto drainer impersonating MerlinSwap. This domain is actively blocked by security vendors and resolves to.

## Summary
PhishDestroy identifies merlinswap-6ib.pages.dev as an elevated-risk crypto drainer phishing domain currently active in the wild. This domain is engineered to deceive users into connecting crypto wallets and signing malicious transactions that drain assets directly.  
This domain was flagged by ScamSniffer and Enkrypt, and VirusTotal confirms detection by 1 out of 95 security vendors. The infrastructure resolves to IP 188.114.97.3 and is currently listed on 2 public blocklists. It leverages a Google Trust Services SSL certificate and is registered through Cloudflare, Inc., indicating a preference for trusted hosting and TLS encryption to appear legitimate. Despite these superficial trust signals, the domain’s purpose—facilitating unauthorized cryptocurrency transfers—remains clear.  
Users should avoid visiting or interacting with merlinswap-6ib.pages.dev entirely. If you’ve already connected your wallet or signed a transaction, revoke any suspicious smart contract approvals immediately using tools like Revoke.cash or Etherscan. Report the domain to PhishDestroy for further analysis and block it at the network level. Always verify URLs via official channels before engaging with any crypto platform.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 1 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["ScamSniffer", "Enkrypt"]

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/29a38100-7f6c-4b09-a082-211cefef260c
- PhishDestroy: https://phishdestroy.io/domain/merlinswap-6ib.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/merlinswap-6ib.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/merlinswap-6ib.pages.dev/
Last updated: 2026-03-31