pdgasusswap[.]com

The domain pdgasusswap.com has been identified as a crypto drainer phishing site specifically designed to impersonate the legitimate cryptocurrency exchange platform PegasusSwap. Analysis indicates this infrastructure was actively targeting users to siphon digital assets through fraudulent transaction prompts. The domain is currently offline, though prior activity suggests it may resurface under similar naming conventions or infrastructure. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on February 21, 2026, an unusually future-dated creation that may indicate registry manipulation or typo-squatting tactics. It resolved to the IP address 188.114.96.3 and was flagged by 6 of 95 security vendors on VirusTotal, with only one security blocklist currently listing it. The site employed a valid SSL certificate issued by Google Trust Services, a common tactic to lend false legitimacy. Detected technologies included Node.js, Express, and Cloudflare with HTTP/3 support, suggesting a modern, low-latency phishing stack designed to evade detection. Gridinsoft assigned a trust score of 0/100, reinforcing its malicious classification. Current status indicates the domain has been taken offline, though the underlying threat persists. Users who interacted with this domain should immediately revoke any connected wallet permissions, transfer remaining assets to a secure wallet, and monitor transaction histories for unauthorized activity. Organizations should block the domain, IP address, and associated SSL certificate fingerprints at the network perimeter. Given the future-dated registration, security teams should monitor for similarly structured domains combining crypto-related terms with slight misspellings or appended characters. This incident underscores the need for real-time transaction verification and hardware wallet usage when engaging with decentralized finance platforms.