us-thorswap-finance[.]pages[.]dev

The domain us-thorswap-finance.pages.dev is currently active and classified as a high-risk brand impersonation site targeting Ethereum. Analysis indicates the domain mimics legitimate decentralized finance platforms, presenting itself as a token swapping service under the false pretense of affiliation with Ethereum infrastructure. Its page title, 'Swap Raydium – Solana-Based Token Swapping Platform,' further misleads users by falsely associating with Solana while impersonating Ethereum-related services. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on March 11, 2026, and resolves to the IP address 172.66.44.179, hosted under AS13335 (Cloudflare, Inc.). It is flagged by 5 of 95 security vendors on VirusTotal and appears on three distinct security blocklists. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging Cloudflare’s infrastructure. The domain has been blocked by multiple security entities, including PhishDestroy, MetaMask, and SEAL, reinforcing its malicious classification. As of the latest assessment, us-thorswap-finance.pages.dev remains active and poses a significant risk to users. Organizations and individuals are advised to block the domain at the network level, update endpoint protection rules to include its IP (172.66.44.179), and monitor for any attempts to access it. Users should be educated on recognizing brand impersonation tactics, particularly in decentralized finance contexts, and verify domain authenticity before interacting with financial platforms. Security teams are recommended to review logs for connections to this domain or its associated IP to identify potential compromise.