hyperswap-exchange[.]org

The domain hyperswap-exchange.org was registered on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. DNS resolution points to the IPv6 address 2606:4700:3030::6815:7001, which belongs to AS13335 operated by Cloudflare, Inc. and is geolocated in the United States. The site presents the page title "HyperSwap – Swap Tokens Instantly on Hyperliquid Exchange," and the listed scam type is wallet/seed phishing, indicating an attempt to harvest cryptocurrency wallet seeds. The threat is classified as brand impersonation targeting "across," meaning it may claim to represent multiple brands or services. The domain appears on a single security blocklist and is listed as blocked by PhishDestroy.

VirusTotal analysis shows that one of ninety‑three security vendors flagged the domain, while Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The SSL certificate is identified as "WE1," and the site is currently reported as offline. Publicly available intelligence does not include a detailed content capture, so the exact copy of any legitimate brand assets cannot be confirmed. The registrar information shows the domain was registered via PublicDomainRegistry, a service often used by malicious operators to obtain anonymity. The Cloudflare front‑end provides DDoS protection and can mask the true origin server, a common tactic observed in phishing infrastructure.

The minimal blocklist exposure (one listing) may reflect recent creation, but the early detection by PhishDestroy indicates that at least one security community has identified the site. The single vendor flag on VirusTotal, combined with a zero trust score, suggests that automated scanners have identified malicious patterns, likely related to the wallet seed harvesting intent. Defenders should incorporate the domain and its resolving IP address into URL filtering, DNS sinkhole, and firewall rule sets, and monitor for re‑activation.