hyperswap-airdrop[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting cryptocurrency users through a fraudulent airdrop scheme. Analysis indicates the site mimics legitimate Hyperswap promotions to deceive victims into connecting wallets or disclosing private keys, likely deploying a crypto drainer payload upon interaction. The specific threat type is a brand impersonation scam with embedded wallet-draining functionality, a common tactic in recent cryptocurrency fraud campaigns. Infrastructure analysis reveals the domain resolves to 172.66.47.170 (US, AS13335 Cloudflare, Inc.) and was registered through Cloudflare on August 21, 2025. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider often abused by threat actors. Detection metrics show 1/95 security vendors on VirusTotal flagging the domain, while PhishDestroy has already blocked it. The domain appears on one security blocklist, and its page title, 'Hyperswap Airdrop — Eligibility, Features,' directly references the impersonated brand to enhance credibility. Mitigation requires immediate blocking of the domain and its resolving IP across network security controls. Organizations should update endpoint protection rules to detect crypto drainer scripts associated with airdrop scams, particularly those hosted on Cloudflare Pages. Users should be warned against interacting with unsolicited airdrop promotions, especially those requiring wallet connections or seed phrase inputs. Security teams are advised to monitor for additional domains using the 'hyperswap' brand name with similar Cloudflare-based hosting patterns, as this may indicate a broader campaign.