solswap-dex-cnp[.]pages[.]dev

The domain solswap-dex-cnp.pages.dev has been identified as a brand impersonation threat targeting the Solana ecosystem. Analysis confirms the domain was designed to mimic a legitimate Solana decentralized application (DApp), as indicated by the page title 'Solana DApp.' The domain is currently offline, but prior activity suggests malicious intent to deceive users into interacting with fraudulent smart contracts or phishing interfaces. Infrastructure analysis reveals the domain was flagged by 13 of 95 security vendors on VirusTotal, indicating a consensus on its malicious nature. It was registered through Cloudflare, Inc. on April 24, 2026, and resolved to the IP address 188.114.97.3. The domain appears on one security blocklist and holds a Gridinsoft trust score of 0/100, further confirming its high-risk classification. Additional technical indicators include the use of HSTS, Cloudflare infrastructure, and HTTP/3, alongside an SSL certificate issued by Google Trust Services. These elements suggest an attempt to appear legitimate while concealing malicious operations. Given the elevated risk level and confirmed brand impersonation, users and organizations are advised to treat this domain as compromised. Immediate actions include blocking the domain and its associated IP address (188.114.97.3) at the network level, updating endpoint protection rules to prevent access, and alerting users to the threat. Security teams should monitor for related domains registered under similar naming conventions or Cloudflare infrastructure. If user interaction with the domain is suspected, initiate account reviews and revoke access to any potentially compromised credentials or wallet connections.