auth-hyperswap-exchange[.]pages[.]dev

This domain, auth-hyperswap-exchange.pages.dev, is identified as a brand impersonation threat targeting Hyperliquid, a decentralized exchange platform. Analysis indicates the site mimics Hyperliquid’s interface under the page title 'HyperSwap Exchange | Fast Token Swaps on Hyperliquid,' likely designed to harvest user credentials or cryptocurrency wallet details through a fraudulent swap interface. No explicit drainer kit signatures were detected, but the infrastructure aligns with phishing campaigns targeting crypto users. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on April 12, 2026, and resolves to the IP address 172.66.47.43. It is flagged by 1 security blocklist and has a VirusTotal detection score of 1/95, indicating minimal but present vendor recognition of malicious activity. The domain uses an SSL certificate issued by Google Trust Services and employs technologies such as HSTS, Cloudflare, and HTTP/3, which are common in both legitimate and malicious sites to evade detection. Google Safe Browsing does not currently list the domain, but its Gridinsoft trust score of 0/100 further confirms its high-risk classification. The domain has been taken offline, likely due to enforcement actions by security providers. However, residual risk remains for users who may have interacted with the site before its removal. Affected individuals should revoke any connected wallet permissions, reset credentials, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include the domain and associated IP, while users are advised to verify domain authenticity before engaging with crypto-related services.