hyyperswap--en-us[.]pages[.]dev

PhishDestroy has opened a formal investigation into hyyperswap--en-us.pages.dev (seed 561f53) for operating a counterfeit HyperSwap cryptocurrency web-portal designed to harvest wallet credentials and seed phrases. This domain presents itself as an official HyperSwap interface while redirecting victims to a malicious smart-contract endpoint that drains connected wallets. The campaign is currently active and is being tracked under the threat type generic_phishing, with a preliminary risk level classified as under_investigation pending further behavioral analysis. This domain was flagged by PhishDestroy on the basis of the following technical indicators and contextual data: VirusTotal score of 7 out of 95 antivirus engines as of the latest scan, indicating zero current detections; DNS resolution to IPv4 address 188.114.97.3, which is part of Cloudflare’s edge network; domain registration facilitated through Cloudflare, Inc.; SSL certificate issued by Google Trust Services LLC; and absence from all major public blocklists at the time of discovery. The domain’s age and creation date are still being enumerated, but the use of a Google-issued certificate and Cloudflare proxying suggests an attempt to mimic legitimacy while obfuscating hosting origin. Organizations and individual users should immediately cease interaction with hyyperswap--en-us.pages.dev and any associated sub-paths or mirrors. If credentials or seed phrases were entered, revoke connected wallet permissions, transfer remaining assets to a newly generated wallet, and rotate all related passwords and 2FA tokens. Report the domain to your email security provider, endpoint protection vendor, and relevant browser blocklists. Consider blocking 188.114.97.3 at the network perimeter. Monitor wallet addresses used in any transactions for signs of further compromise. Always verify the canonical domain of HyperSwap (hyperfund.io) and use bookmarks stored in an offline vault before initiating any cryptocurrency transaction.