defillama-swap-eng[.]pages[.]dev

Analysis of defillama-swap-eng.pages.dev shows it was created on 21 February 2026 and is currently taken offline. The domain resolves to 172.66.47.161, an IP owned by Cloudflare (AS13335) located in the United States. DNS is served by the Cloudflare‑provided nameservers meelani.ns.cloudflare.com and khalid.ns.cloudflare.com, indicating the registrar is Cloudflare, Inc. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming a valid HTTPS endpoint. HTTP responses return 403, and the site advertises HSTS and HTTP/3, consistent with Cloudflare infrastructure. Content‑level evidence is limited to the page title “DefiLlama Swap – Best DEX Aggregator”, suggesting an attempt to masquerade as the DefiLlama decentralized‑finance aggregator.

The threat classification recorded as wallet/seed phishing aligns with the observed brand‑target field “across”, indicating the campaign may aim at multiple DeFi users. Google Safe Browsing flags the domain for social engineering, and VirusTotal records four of ninety‑one scanners flagging it, demonstrating partial detection across anti‑malware engines. Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one public blocklist. PhishDestroy has already blocked the host.

The limited public evidence precludes confirmation of the exact phishing payload or credential‑capture mechanisms. Defenders should block the domain and its IP at network perimeters, add the host to URL filtering and threat‑intelligence feeds, and monitor for similar sub‑domains using the same Cloudflare nameservers or certificate. Continuous re‑scanning with multi‑vendor services is advised to capture any evolving malicious content. The combination of low trust scores, social‑engineering safe‑browsing flag, and partial VirusTotal detections warrants elevated risk handling despite the current offline status.