hyperswap-airdrop-en-cdn[.]pages[.]dev

This domain, hyperswap-airdrop-en-cdn.pages.dev, is assessed as a high-risk instance of brand impersonation. The domain impersonates a legitimate airdrop campaign, aiming to deceive users into providing sensitive information or performing actions that could lead to financial loss.

Analysis indicates that the domain resolves to the IP address 172.66.44.250, which is hosted by Cloudflare, Inc. in California, USA. The domain was created on April 05, 2026, and is currently active. The SSL certificate is issued by Google Trust Services, which could be leveraged to gain user trust. Notably, only 1 out of 95 security vendors on VirusTotal flagged this domain as malicious, suggesting a low level of detection that could allow it to evade basic security measures. The domain appears on one security blocklist and is blocked by PhishDestroy. These factors collectively indicate that the domain is actively being used to impersonate a legitimate brand and poses a significant threat to users who may interact with it.

To mitigate the risks associated with this brand impersonation threat, users are advised to exercise caution when encountering unsolicited airdrop offers or requests for sensitive information. Organizations should update their threat intelligence databases to include this domain and consider implementing more stringent security measures, such as advanced threat detection tools and user education on identifying phishing attempts. Additionally, network administrators should block the IP address 172.66.44.250 and monitor for any related malicious activity. Reporting the domain to Cloudflare and Google Trust Services for further investigation and potential takedown is also recommended.