psgasusswap[.]com

Analysis indicates that the domain psgasusswap.com is actively serving a cryptocurrency‑focused fraud page titled “PegasusSwap – Crypto Exchange Platform”. The site is hosted behind Cloudflare’s network (ASN13335, United States) and resolves to the IP address 172.67.138.201, which is owned by Cloudflare, Inc. The TLS certificate presented is issued by Google Trust Services under the WE1 intermediate, confirming the use of a legitimate certificate authority but offering no assurance about the underlying content. HTTP requests receive a 200 OK response and the service advertises the use of Node.js, Express, and HTTP/3, consistent with a modern web application stack. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited, and the registration details are publicly visible.

Reputation checks show a Gridinsoft trust score of 0 / 100 and detection by PhishDestroy, with the domain currently listed on one external blocklist. VirusTotal analysis reports that two of ninety‑three scanning engines flagged the domain, indicating at least limited detection of malicious behavior. No additional public threat‑intel sources (e.g., OTX, Safe Browsing) are referenced in the available data.

The combination of a recent registration, low trust score, active hosting, and detection by multiple security vendors suggests a high‑risk profile consistent with a generic crypto‑scam operation. Defenders should block network connections to the domain and its resolving IP address, add the domain to URL filtering and email security policies, and monitor for any related phishing attempts that reference “PegasusSwap”. Continuous re‑evaluation is advised, as further indicators such as payload samples or victim reports may emerge.