swap-defiillama--com[.]pages[.]dev

The domain swap-defiillama--com.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is currently taken offline. DNS resolution points to IP address 188.114.97.3, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. The site served an SSL certificate issued by Google Trust Services under the WE1 label, and transport layers reported the presence of HSTS and HTTP/3, indicating a modern web stack. An HTTP request returned a 403 status code, and the page title presented by the server was “Suspected phishing site | Cloudflare,” matching the Cloudflare block page.

Google Safe Browsing classified the URL as a social engineering threat, and the domain is listed on at least one security blocklist, including PhishDestroy, which has actively blocked it. Independent analysis by Gridinsoft assigned a trust score of 0 out of 100, reflecting extreme suspicion. VirusTotal scanned the domain in 93 vendor engines, with 12 vendors flagging it as malicious, reinforcing the conclusion that the infrastructure was used for a crypto‑draining campaign. Nameserver records list hans.ns.cloudflare.com and rosalyn.ns.cloudflare.com, both Cloudflare‑controlled.

No additional content or functional page evidence is available because the site is offline, leaving the exact phishing payload or victim interaction unknown. Defenders should continue to enforce blocklist rules for the IP 188.114.97.3, monitor for any re‑registration of the domain or similar sub‑domains under the same Cloudflare account, and consider adding the domain to internal deny lists. Ongoing vigilance on traffic to Cloudflare‑served IPs with similar certificate profiles and on URLs flagged by Google Safe Browsing is advised, as threat actors may shift to new domains while retaining the same hosting infrastructure.