nativeswap-landing[.]pages[.]dev

This domain, nativeswap-landing.pages.dev, is identified as an active phishing site targeting cryptocurrency users. The site mimics a legitimate cross-chain swap platform, presenting itself under the title 'Cross-Chain Crypto Swaps at the Lowest Fees | NativeSwap.' Its primary threat involves tricking users into entering sensitive wallet credentials or authorizing fraudulent transactions, potentially leading to unauthorized access and asset theft. The site employs social engineering tactics, leveraging the appearance of a legitimate service to exploit trust in decentralized finance (DeFi) platforms. Analysis indicates this domain was registered on March 21, 2025, through Cloudflare, Inc., and currently resolves to the IP address 172.66.47.97, hosted on Cloudflare’s infrastructure (AS13335). Detection data from VirusTotal shows that only 1 out of 95 security vendors has flagged this domain as malicious, suggesting it may still evade widespread detection. The domain appears on one security blocklist and is blocked by at least one threat intelligence provider. Its SSL certificate, issued by Google Trust Services (WE1), further obscures its malicious nature by providing an appearance of legitimacy. Users who have visited nativeswap-landing.pages.dev or interacted with its content should take immediate action to mitigate risks. First, disconnect any wallets or accounts linked to the site and revoke any suspicious transaction approvals using a blockchain explorer or wallet management tool. Monitor connected accounts for unauthorized activity and consider transferring assets to a new, secure wallet if compromise is suspected. Report the domain to relevant security platforms and financial institutions to aid in broader threat mitigation efforts. Exercise caution with similar sites, verifying domain authenticity through official sources before engaging.