ppegasusswap[.]com

Analysis of ppegasusswap.com indicates a crypto-themed phishing domain targeting users of cryptocurrency exchange platforms. The domain was registered on February 23, 2026, through NiceNIC International Group Co., Limited, and is hosted behind Cloudflare (AS13335) at IP 172.67.202.191, with nameservers aspen.ns.cloudflare.com and tanner.ns.cloudflare.com. The page title, 'PegasusSwap - Crypto Exchange Platform,' suggests an attempt to mimic legitimate crypto exchange services, though no specific brand impersonation is confirmed from available data. No SSL certificate was detected, increasing the risk of credential interception or fraudulent transactions.

The domain appears on one security blocklist and is flagged by PhishDestroy. VirusTotal reports detection by 6 of 93 security vendors, though this does not confirm malicious activity on its own. As of July 25, 2026, the domain is offline, but defenders should treat it as a potential threat vector for crypto-related fraud. Infrastructure analysis reveals reliance on Cloudflare, a common tactic to obscure hosting origins and evade takedowns.

The absence of SSL further weakens security posture, aligning with typical phishing domain characteristics. Defenders are advised to block the domain and IP at perimeter controls, monitor for related infrastructure (e.g., subdomains, newly registered lookalike domains), and alert users to potential crypto scams leveraging the PegasusSwap branding. No evidence links this domain to a known phishing kit or specific threat actor, and further forensic analysis would require access to historical HTTP responses or payload samples.