retikswap[.]pages[.]dev

This domain, retikswap.pages.dev, is an active phishing site designed to impersonate Retik Finance, a legitimate cryptocurrency platform. The site presents a fraudulent multi-chain swap interface, likely intended to harvest user credentials, private keys, or facilitate unauthorized fund transfers. Analysis confirms this infrastructure is actively targeting individuals engaged in decentralized finance (DeFi) transactions. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on May 30, 2024, and currently resolves to the IP address 188.114.97.3, hosted under AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common pattern for phishing sites leveraging legitimate certificate authorities. Security telemetry indicates the domain is flagged by 3 of 95 vendors on VirusTotal and appears on one security blocklist. The page title, "Retik | Multi-Chain Swap," directly mimics the branding of the legitimate Retik Finance platform, increasing the likelihood of successful deception. As of the latest verification, retikswap.pages.dev remains active and operational. Organizations and individuals are advised to block the domain and associated IP address (188.114.97.3) at the network level. Users who may have interacted with this site should immediately revoke any connected wallet permissions, rotate credentials, and monitor accounts for unauthorized transactions. Security teams are encouraged to correlate this indicator with other known phishing infrastructure targeting DeFi platforms.