apps-hyperswap[.]xyz

This domain, apps-hyperswap.xyz, is under investigation for hosting a decentralized exchange (DEX) phishing scheme targeting cryptocurrency users. Registered on March 26, 2026, through Dynadot LLC, the domain currently resolves to IP address 172.67.200.28, which is associated with Cloudflare infrastructure located in Canada. Analysis indicates the domain is actively blocked by one security vendor, PhishDestroy, and appears on a single security blocklist. The SSL certificate, issued by Let's Encrypt, remains valid, though this alone does not mitigate the threat posed by the domain's content. Infrastructure analysis reveals the domain uses Cloudflare nameservers (laylah.ns.cloudflare.com and tate.ns.cloudflare.com), a common tactic to obscure hosting details and evade takedowns. At present, the domain returns an HTTP 403 status, suggesting either restricted access or a placeholder page awaiting activation. Despite this, five out of ninety-five security vendors on VirusTotal flag the domain as malicious, aligning with its classification as a high-risk threat. AlienVault OTX records the domain in one threat intelligence pulse, further corroborating its association with phishing activity. The scam type has been identified as a DEX scam, likely designed to mimic legitimate decentralized exchange platforms to harvest credentials or private keys. While the exact phishing kit or payload remains unconfirmed, the domain's creation date and Cloudflare-backed infrastructure are consistent with patterns observed in similar campaigns. Defenders should treat this domain as actively malicious and prioritize blocking resolutions to 172.67.200.28 at the network level. Monitoring for related subdomains or IP shifts is recommended, as threat actors frequently rotate infrastructure to maintain persistence.