defillama-swap-app[.]pages[.]dev

Analysis of defillama-swap-app.pages.dev confirms it as a high-risk crypto drainer phishing domain, currently offline but previously active in cryptocurrency scams. The domain was registered on February 21, 2026, through Cloudflare, Inc., and hosted on Cloudflare's infrastructure (AS13335) with an IP resolution of 188.114.96.3, located in the United States. The site's page title, 'Suspected phishing site | Cloudflare,' aligns with its classification by multiple security vendors, including Google Safe Browsing, which flags it for social engineering. Gridinsoft and Scamadviser both assign the lowest possible trust scores (0/100 and 1/100, respectively), explicitly categorizing it as a crypto scam.

The domain appears on at least one security blocklist, and VirusTotal reports 12 detections from 93 security vendors, further corroborating its malicious nature. Infrastructure analysis reveals the domain uses Cloudflare nameservers (leif.ns.cloudflare.com and dara.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), a common configuration for both legitimate and malicious sites leveraging Cloudflare's services. The HTTP status returned is 403 (Forbidden), indicating the site is either intentionally blocked or taken offline, though this does not preclude reactivation. The domain is also blocked by PhishDestroy, a specialized anti-phishing service.

While the exact mechanics of the crypto drainer remain unconfirmed due to the site's current offline status, the available evidence—including scam categorization, trust scores, and detection vendor flags—strongly supports its classification as a crypto-focused phishing operation. Defenders should treat this domain as compromised and maintain blocks on DNS, firewall, and proxy levels. Organizations handling cryptocurrency transactions should monitor for references to this domain in logs or user reports, as it may have been distributed via phishing links or malicious advertisements.