pegasuwswap[.]com

The domain pegasuwswap.com was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (AS13335) with the IP address 104.21.13.229 located in the United States. The site resolves using the Cloudflare nameservers aspen.ns.cloudflare.com and tanner.ns.cloudflare.com and presents a valid SSL certificate issued by Google Trust Services under the WE1 hierarchy, indicating that TLS is correctly configured. HTTP requests return a 200 status code and the page title is reported as "PegasusSwap - Crypto Exchange Platform," suggesting the site is positioned as a cryptocurrency exchange. Technical fingerprinting shows a Node.js runtime with the Express framework, and the service is delivered over HTTP/3, consistent with modern web stacks.

Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist. VirusTotal analysis shows that 2 of 93 scanning engines have flagged the domain, reinforcing the suspicion of malicious activity. The threat classification in the intelligence is "Crypto Scam" and the site is currently listed as active, with PhishDestroy confirming it is blocked on their platform. Defenders should treat pegasuwswap.com as a high‑risk indicator of phishing or credential‑harvesting activity targeting cryptocurrency users.

Network sensors should block outbound connections to the IP 104.21.13.229, and DNS filtering should deny resolution of the domain. Security teams should monitor for any email or messenger campaigns that reference PegasusSwap or similar branding, and should include the domain in threat‑intel feeds to alert users and endpoint protection solutions. Although the page content has not been inspected directly, the combination of a zero trust score, active blocklist presence, multiple vendor detections, and the explicit crypto‑exchange branding strongly suggests a malicious operation designed to deceive users into submitting private keys or funds.