defillama-swap-get[.]pages[.]dev

The domain defillama-swap-get.pages.dev has been identified as a brand impersonation threat, specifically a crypto drainer masquerading as the legitimate DeFiLlama Swap platform while targeting the Across brand. This site attempts to trick users into connecting their wallets and approving malicious transactions that drain their funds. The page title claims to be "DeFiLlama Swap — Decentralized Token Swap Aggregator," but it is a fraudulent copy designed to steal cryptocurrency.

Technical analysis reveals that only 1 out of 95 security vendors on VirusTotal flagged this domain, indicating low detection and a high risk of bypassing traditional security tools. The domain was registered on August 26, 2025, through Cloudflare, Inc., and resolves to IP address 172.66.45.2. It is not listed on Google Safe Browsing, meaning it may not be blocked by Chrome or other browsers, and it appears on only 1 security blocklist. The SSL certificate is issued by Google Trust Services (WE1), which gives the site a false sense of legitimacy.

As of now, defillama-swap-get.pages.dev remains active and operational. Users who have interacted with this site should immediately revoke any token approvals given to the contract address associated with the drainer and transfer remaining funds to a new, secure wallet. PhishDestroy recommends that all users avoid this domain entirely and report it to relevant authorities and security vendors to increase blocklist coverage. The combination of low vendor detection and active status makes this a critical threat to the crypto community.