paxswap[.]pages[.]dev

PhishDestroy identifies paxswap.pages.dev as a live domain actively masquerading as a decentralized exchange. The page is hosted on Cloudflare Pages with a Google Trust Services SSL certificate and resolves to IP 188.114.96.3. Because the page title is identical to the domain itself and no antivirus engines on VirusTotal flagged it out of 95 scans as of this advisory, the threat remains under constant monitoring while the investigation continues. This domain was registered through Cloudflare, Inc. using Pages.dev infrastructure, a legitimate service often abused for quick site deployment. The fully qualified domain points to a single IP address (188.114.96.3) operated by Cloudflare, giving the actor low-cost, high-anonymity hosting. With zero detections on VirusTotal at the time of discovery, the site represents an emerging attack surface typical of opportunistic credential theft and wallet-draining campaigns targeting crypto users. The absence of detections does not imply safety; rather, it highlights the speed at which adversaries launch infrastructure before automated defenses catch up. If you visited paxswap.pages.dev, stop interacting immediately and disconnect any connected wallets. Do not sign transactions or enter private keys or seed phrases on any page related to this domain. Clear browser cache and cookies for the site. Block the domain and IP 188.114.96.3 in your firewall or hosts file. Report any unauthorized transactions to your wallet provider and change passwords linked to the exposed session. Monitor blockchain activity for outgoing transfers. If cryptocurrency funds are drained, consider filing a police report and a complaint with CERT or your national cybercrime unit. Act quickly: time is critical when funds are at risk.