swap-defillama-io-us[.]pages[.]dev

On 25 July 2026, the domain swap-defillama-io-us.pages.dev was observed serving a page titled “DefiLlama Swap | Best DeFi Swap Aggregator”. The site is hosted behind Cloudflare’s network (ASN 13335) and resolves to IP 172.66.47.94 located in the United States. The domain was registered on 21 February 2026 through Cloudflare, Inc., and uses a Google Trust Services certificate issued to *.pages.dev, indicating standard Cloudflare‑provided TLS. HTTP response code 403 is returned, and the server advertises HSTS and HTTP/3, confirming modern security headers. VirusTotal analysis shows that nine of ninety‑three antivirus and URL scanning engines flagged the domain as malicious, and the domain appears on a single external blocklist.

Google Safe Browsing classifies the URL as “social engineering”, and PhishDestroy has added it to its block list. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The page title references DefiLlama, a known DeFi analytics platform, but the intelligence set lists the impersonated brand as “across”. This suggests the operator may be attempting to leverage the credibility of multiple DeFi‑related services to lure victims.

The combination of a brand‑related page title, a low‑trust score, and detection by multiple security vendors indicates a high likelihood of credential‑stealing or crypto‑draining activity. Although the site currently returns HTTP 403 and is marked offline, the immediate threat surface is limited to reconnaissance and potential re‑hosting. Defenders should add swap-defillama-io-us.pages.dev to URL filtering rules, monitor for any re‑registration of the domain or similar sub‑domains under the pages.dev namespace, and enforce strict controls on outbound connections to Cloudflare‑served IP ranges that resolve to suspicious content. Continuous observation of Google Safe Browsing and VirusTotal feeds is recommended to detect any changes in detection status.