hyperswaps-vote-upcoming-rewards-date-treasury-pool-reward[.]pages[.]dev

Analysis indicates that the domain hyperswaps-vote-upcoming-rewards-date-treasury-pool-reward.pages.dev was registered on March 23 2026 through Cloudflare, Inc. The authoritative nameservers are ashton.ns.cloudflare.com and nancy.ns.cloudflare.com, and the domain resolves to the Cloudflare‑owned IP address 188.114.97.3 located in Canada. The site presented the page title “Hyperswap” and is classified as a crypto‑related generic phishing operation. SSL is provided by Google Trust Services under the WE1 certificate, and the server enforces HSTS while supporting HTTP/3, indicating a modern Cloudflare edge configuration. HTTP requests return a 403 status, and the domain is currently taken offline.

Reputation checks show a Gridinsoft trust score of 0/100 and inclusion on four external blocklists (PhishDestroy, MetaMask, ScamSniffer, SEAL). VirusTotal reports that the domain was scanned by 94 vendors, none of which flagged it at the time of analysis. The combination of a newly created domain, low trust score, crypto‑scam labeling, and presence on multiple blocklists suggests malicious intent despite the lack of detections.

Uncertainty remains regarding the specific payload or luring techniques because the page content has not been captured. Defenders should continue to block the domain at network perimeter, monitor DNS queries for the associated IP and nameservers, and add the domain to internal allow‑list exclusions. Further investigation should include retrieving a snapshot of the page content, checking for any associated phishing kits, and correlating user reports that reference the “Hyperswap” title.