hyperswapv3[.]pages[.]dev

This domain, hyperswapv3.pages.dev, is flagged as an active phishing infrastructure designed for brand impersonation and cryptocurrency theft. Analysis indicates it targets users of Across Protocol, a decentralized bridging platform, by presenting itself as HyperSwap V3, an advanced decentralized exchange. The site employs social engineering tactics to trick victims into connecting wallets, likely deploying a crypto drainer script to siphon funds upon interaction. No specific drainer kit has been conclusively identified, but the operational pattern aligns with known wallet-draining campaigns targeting DeFi users. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 188.114.97.3, hosted on Cloudflare’s AS13335 network in the United States. It was registered through Cloudflare on August 23, 2025, and uses an SSL certificate issued by Google Trust Services (WE1). The page title, 'HyperSwap V3 – Advanced Decentralized Exchange,' mirrors legitimate DeFi branding to enhance credibility. As of the latest scan, VirusTotal reports 1 out of 95 security vendors flagging the domain, while one additional blocklist has recorded its malicious activity. No detections were reported by Google Safe Browsing at the time of analysis. The domain remains active and poses a high risk to users of Across Protocol and similar DeFi platforms. While one security vendor has blocked access, the limited detection rate suggests the infrastructure may still evade widespread filtering. Users are advised to verify domain authenticity before interacting with any DeFi-related websites, particularly those prompting wallet connections. Wallet addresses or transaction hashes associated with this domain should be treated as malicious and reported to relevant blockchain security platforms for further tracking.