hyperswap-rpc[.]pages[.]dev

hyperswap-rpc.pages.dev is currently active and classified as a high‑risk crypto phishing site. The domain was registered on 10 June 2025 through Cloudflare and uses the nameservers ray.ns.cloudflare.com and jessica.ns.cloudflare.com. DNS resolution points to 104.21.80.1, which belongs to AS13335 (Cloudflare, Inc.) and the site serves a TLS certificate issued by Google Trust Services / WE1. HTTP responses return status 200 and the server advertises HSTS and HTTP/3, indicating a modern web stack. The page title observed is “Home | Mainnet Sync app”, suggesting an attempt to impersonate a blockchain‑related application, but the content of the page has not been captured, so the exact phishing mechanics remain unknown. VirusTotal analysis shows that 10 of 93 security vendors flag the domain, and it appears on one external blocklist; PhishDestroy has already blocked it. Given the combination of a recent registration, Cloudflare‑fronted infrastructure, a valid SSL certificate, and multiple vendor detections, defenders should treat any traffic to this host as malicious. Recommended actions include adding hyperswap-rpc.pages.dev to deny‑list filters, monitoring DNS queries for the domain and related subdomains, and enforcing email gateway rules to block URLs containing “pages.dev” that reference “Mainnet Sync”. Continuous observation of Cloudflare‑hosted IP ranges for new domains with similar naming patterns is advised.