peggasusswap[.]com

This domain is flagged as an elevated-risk cryptocurrency phishing site targeting users of decentralized exchange platforms. Analysis indicates the site mimics legitimate crypto trading interfaces to harvest credentials and private keys, a tactic commonly associated with wallet-draining attacks. The domain presents itself as PegasusSwap, a fictitious exchange platform, to exploit users seeking alternative trading services. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolves to IP address 172.67.172.242 and employs Cloudflare for hosting, alongside Node.js and Express for backend operations. The SSL certificate is issued by Google Trust Services, and the site supports HTTP/3. Detection metrics show 6 out of 95 security vendors on VirusTotal flagged the domain as malicious, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist and is actively blocked by PhishDestroy. Mitigation requires immediate blocking of the domain and its associated IP at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to cryptocurrency phishing sites, particularly those impersonating exchange platforms. Users must be educated to verify domain registration dates, SSL certificate issuers, and security vendor detections before interacting with crypto-related websites. Wallet software should enforce strict origin checks to prevent unauthorized transactions initiated from phishing domains.