layer2-henjin-xyz[.]pages[.]dev

This domain, layer2-henjin-xyz.pages.dev, is a high-risk phishing site impersonating a Taiko decentralized exchange (DEX) platform under the name 'Henjin DEX.' The site presents a fraudulent token swap interface designed to harvest cryptocurrency wallet credentials, seed phrases, and private keys from unsuspecting users. Analysis of the page title, 'Swap Tokens on Taiko | Henjin DEX | Taiko DEX,' confirms the domain mimics legitimate Taiko DEX branding to deceive users into connecting wallets or entering sensitive information, which is then exfiltrated to attacker-controlled infrastructure. Infrastructure analysis reveals the domain was registered through Cloudflare Pages on March 27, 2026, and currently resolves to the IP address 172.66.44.216, hosted by Cloudflare, Inc. in California. The site is secured with a Google Trust Services SSL certificate (WE1), which may lend a false sense of legitimacy. Despite this, the domain appears on one security blocklist and is flagged by 1 out of 95 security vendors on VirusTotal, indicating limited but confirmed detection of malicious activity. The domain remains active as of this report, with no takedown or mitigation measures observed. Users who have visited layer2-henjin-xyz.pages.dev or interacted with its content should immediately revoke any connected wallet permissions and transfer assets to a new, secure wallet. All credentials or seed phrases entered on the site must be considered compromised. Monitor transaction histories for unauthorized activity and report the incident to relevant blockchain security teams or fraud response platforms. Avoid reusing passwords or wallet connections across platforms, and verify domain authenticity through official project channels before engaging with decentralized finance (DeFi) interfaces.