auth-sunswaap-v2-cdn-us[.]pages[.]dev

auth-sunswaap-v2-cdn-us.pages.dev is a confirmed brand impersonation site specifically targeting the Solana cryptocurrency ecosystem. The domain is currently active and poses a high risk to users seeking legitimate Solana services. This threat is classified as a crypto drainer, designed to trick victims into connecting their wallets and subsequently stealing funds.

Technical analysis reveals that the domain is flagged by 2 out of 95 VirusTotal vendors, indicating low but notable detection. It is registered through Cloudflare, Inc. and resolves to IP 172.66.44.153. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of security. The domain was created recently and is not present on major blocklists, though its malicious nature is confirmed by threat intelligence feeds. Trust scores from community sources are low, reflecting its suspicious profile.

The site remains active and accessible. Users are strongly advised not to visit the domain, enter any credentials, or connect cryptocurrency wallets. Recommendations include blocking the domain at the network level, reporting it to Cloudflare and Google Safe Browsing, and educating users about brand impersonation tactics. Organizations should update their threat intelligence feeds with this indicator to prevent compromise.