hyperswap[.]inc

Analysis of hyperswap.inc indicates that the domain was registered on 21 February 2026 through Porkbun LLC and is served by three Porkbun nameservers (curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, maceio.ns.porkbun.com). The domain resolves to the IPv4 address 194.182.176.191, which belongs to AS61098 (Akenes SA) and is geolocated to Bulgaria. No TLS certificate is observed for the host, suggesting that the site operated without HTTPS. The only visible page element is the title “SWAP”, which aligns with the reported crypto‑scam classification.

The domain appears on a single security blocklist and is specifically listed as blocked by PhishDestroy. VirusTotal scanning recorded a single positive detection out of 93 scanned security vendors, confirming at least one vendor flagged the domain as malicious. As of the report date (22 July 2026) the domain’s HTTP service is reported offline, preventing live content retrieval and limiting forensic observation of payloads or redirects. The elevated risk rating reflects the combination of recent registration, association with a known crypto‑scam, presence on a blocklist, and the positive vendor detection.

Defenders should proactively deny any network traffic to 194.182.176.191 and add hyperswap.inc to internal URL filtering and DNS sinkhole policies. Monitoring of the associated Porkbun nameservers for newly created sibling domains is recommended, as threat actors often reuse registrar and hosting configurations. Although the site is currently offline, the infrastructure components (IP, nameservers, registrar) remain active and could be re‑used for future campaigns; continuous vigilance is advised.