thorswap-finance[.]pages[.]dev

Analysis of thorswap-finance.pages.dev shows a domain registered on February 21, 2026 through Cloudflare, Inc. The site resolves to IP address 172.66.44.153, which belongs to Cloudflare’s AS13335 network located in the United States. The domain is presently taken offline and returns an HTTP 403 status code, but the underlying infrastructure indicates the presence of HSTS, HTTP/3, and a TLS certificate issued by Google Trust Services (WE1). The page title observed during the brief live period – “Decentralized Dapps – We are unifying Web3 by providing best-in-class, self‑custodial, and multichain support” – suggests a Web3‑oriented narrative, yet intelligence explicitly links the domain to a fake airdrop campaign impersonating Coinbase.

The Gridinsoft trust score of 0 / 100 flags the domain as highly suspicious. VirusTotal analysis recorded six detections out of ninety‑three scanning engines, and the domain appears on two security blocklists, specifically PhishDestroy and ScamSniffer. Nameservers casey.ns.cloudflare.com and virginia.ns.cloudflare.com confirm Cloudflare hosting.

While the site is offline and the full page content cannot be inspected, the combination of a Coinbase impersonation claim, a fake‑airdrop lure, low trust score, multiple vendor detections, and blocklist listings provides strong evidence of malicious intent. Defensive recommendations include adding thorswap-finance.pages.dev to URL filtering and DNS block lists, monitoring for any re‑activation of the domain or similar Cloudflare‑hosted domains targeting Coinbase users, and educating end‑users about unsolicited airdrop offers that reference Coinbase. Continuous threat‑intel feeds should be consulted for potential redeployment of the infrastructure, and any observed traffic to the IP address should be logged and investigated for credential‑harvesting activity.