saucerswap[.]pages[.]dev

Analysis of saucerswap.pages.dev on 2026-08-03 shows that the domain has been observed in a generic phishing operation. The domain was submitted to VirusTotal where it received scans from 91 antivirus and URL scanning engines; none of the engines reported a detection at the time of analysis. Absence of detections does not imply the site is benign, and the lack of a positive verdict leaves the payload or landing page content unverified.

The domain appears on a single security blocklist and is actively blocked by the PhishDestroy service, indicating that threat-intel feeds have classified it as malicious. No additional public indicators such as an OTX pulse, registrar information, hosting IP, SSL certificate details, HTTP response codes, or Google Safe Browsing status are currently available in the evidence set. Consequently, the technical profile of the infrastructure remains limited to its presence on the blocklist and the VirusTotal scan metadata.

Defenders should treat the domain as hostile and incorporate it into URL filtering, DNS sinkhole, and endpoint protection rules. Continuous monitoring of the domain for changes in hosting, certificate issuance, or appearance in additional threat feeds is recommended, as further activity could reveal the underlying phishing kit or target brand. Because the domain is still marked as active and under investigation, any observed traffic to or from saucerswap.pages.dev should be logged and examined for credential harvesting or credential-stealing behavior.