hyperswapairdrop[.]pages[.]dev

Analysis indicates that the domain hyperswapairdrop.pages.dev is an active crypto-draining scam targeting users through a fraudulent airdrop scheme. Registered on August 23, 2025, via Cloudflare, Inc., the domain resolves to IP address 172.66.47.83, hosted on Cloudflare's network (AS13335). The page title, 'HyperSwap Airdrop – Claim Free Tokens,' suggests an attempt to lure victims with promises of free cryptocurrency, a common tactic in crypto drainer operations. Infrastructure analysis reveals the use of Cloudflare nameservers (thea.ns.cloudflare.com and benedict.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), which may contribute to the site's appearance of legitimacy. The domain is currently flagged on one security blocklist, specifically PhishDestroy, and has been classified as a crypto scam. Gridinsoft assigns it a trust score of 0/100, reinforcing its suspicious status. While the domain was scanned by 93 vendors on VirusTotal, none have flagged it as malicious at the time of analysis; however, the absence of detections does not confirm safety. Technologies detected on the domain include HSTS and HTTP/3, which are consistent with modern web infrastructure but do not mitigate the underlying threat. Defenders should treat this domain as high-risk due to its active status, association with a known phishing kit (Airdrop Scam), and targeting of cryptocurrency users. Network-level blocking of the IP 172.66.47.83 and domain-based filtering are recommended to prevent user exposure. Further monitoring is advised, as the domain remains under investigation and additional indicators of compromise may emerge.