portal-en-dfillaa-swap[.]pages[.]dev

Analysis of portal-en-dfillaa-swap.pages.dev indicates that the domain is a confirmed crypto‑focused phishing infrastructure. The site was created on February 21, 2026 and is registered through Cloudflare, Inc., using the authoritative nameservers brian.ns.cloudflare.com and gene.ns.cloudflare.com. DNS resolution points to the IPv6 address 2606:4700:310c::ac42:2c9f, which belongs to AS13335 Cloudflare, Inc., located in the United States. The TLS certificate is issued by Google Trust Services under the WE1 profile, confirming the use of a legitimate certificate chain but not providing any assurance of benign activity. The page title returned by the server is "Suspected phishing site | Cloudflare" and the HTTP response code is 403, suggesting that access is intentionally restricted, consistent with the reported offline status.

Security telemetry shows that the domain has a Gridinsoft trust score of 0 out of 100, reflecting a complete lack of trust. Google Safe Browsing flags the site for social engineering, and the domain appears on a single security blocklist, where it is listed as blocked by PhishDestroy. VirusTotal scans report that ten of ninety‑three security vendors flag the domain, further corroborating malicious intent. Detected web technologies include HSTS, Cloudflare services, and HTTP/3, indicating modern delivery mechanisms are in use.

The classification as a crypto scam derives from the supplied intelligence, but the exact payload or lure employed by the site remains unknown because no page content has been captured. Defenders should block the domain at perimeter defenses, monitor for any resolution to the same IPv6 address, and consider updating threat feeds to include the associated Cloudflare nameservers. Continuous observation of the IP range associated with AS13335 is advised, as Cloudflare often hosts multiple malicious actors.