swap-defillama-en-us[.]pages[.]dev

The domain swap-defillama-en-us.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 172.66.47.171, which is owned by AS13335 Cloudflare, Inc. in the United States. The site employed a TLS certificate issued by Google Trust Services under the WE1 root, indicating a valid HTTPS configuration, and the server presented HTTP Strict Transport Security (HSTS) and HTTP/3, both typical of Cloudflare‑protected services. Analysis of the page title returned by the site – “DefiLlama Swap | Top DeFi Analytics and Token Swaps” – aligns with the declared scam type of a crypto scam and a brand‑impersonation campaign targeting the broader DeFi analytics ecosystem.

Security‑vendor scanning on VirusTotal recorded nine detections out of ninety‑three scanners, and Google Safe Browsing flagged the domain for social‑engineering content. The domain appears on a single external blocklist, specifically PhishDestroy, and Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious classification. An HTTP 403 response was observed, and the current operational status is offline, limiting further content inspection.

Defenders should immediately add the domain to outbound filtering rules and block the associated IP range (172.66.47.0/24) if feasible. Continuous monitoring of Cloudflare‑registered domains with similar naming patterns, especially those employing DeFi‑related terminology, is advised. Because the site is already taken offline, threat actors may attempt to reactivate the domain or spin up replicas on adjacent subdomains; thus, threat‑intel feeds should be updated to include this indicator of compromise and any future observations should be correlated with the listed identifiers (ASN, SSL issuer, and blocklist entry).