arbswap-app[.]pages[.]dev

PhishDestroy has identified arbswap-app.pages.dev as an active brand impersonation threat, specifically a crypto drainer designed to steal cryptocurrency from users of the Across protocol. The domain was created on July 25, 2025, and its page title, "Arbswap," is a deliberate misspelling of the legitimate Across platform, indicating an attempt to trick visitors into connecting their wallets and approving malicious transactions.

Technical analysis reveals several red flags. VirusTotal reports 1 out of 95 security vendors flagging this domain, and it appears on one security blocklist, suggesting limited but growing recognition of the threat. The domain is registered through Cloudflare, Inc. and resolves to IP address 172.66.47.55. Despite being newly created, it has an SSL certificate issued by Google Trust Services (WE1), a tactic often used to create a false sense of security. Google Safe Browsing has not yet blocked the domain, increasing the risk to users who may not be cautious.

As of this report, arbswap-app.pages.dev remains active and operational. PhishDestroy recommends that users avoid visiting the domain and never connect their Web3 wallets to any site with a similar name. The remaining risk is high due to the domain's active status and the potential for financial loss. Users should always double-check URLs and only interact with official Across channels. If you have already connected your wallet, immediately revoke contract approvals and move funds to a secure wallet.