hyperswep[.]com

Analysis of hyperswep.com, reported on July 22 2026, shows a domain that is currently offline but exhibits several indicators of a brand‑impersonation campaign targeting Hyperliquid. The site title retrieved from historical records reads “Swap Tokens | HyperSwap Exchange on Hyperliquid,” directly referencing the victim brand and suggesting a cryptocurrency‑swap façade. The domain was registered on 10 September 2025 through Hosting Concepts B.V. operating as Registrar.eu, giving it less than a year of age at the time of detection. DNS resolution points to the IP address 157.173.214.130, which belongs to AS47583 hosted by Hostinger International Limited in the United States. The name servers listed are ns1.dns-parking.com and ns2.dns-parking.com, typical of parked or rapidly provisioned domains.

No TLS certificate is presented, which is consistent with the reported offline status and further hampers legitimate user trust. Security‑vendor scanning on VirusTotal recorded four positive detections out of ninety‑five scanners, reinforcing the malicious classification. Independent blocklist feeds have already added the domain to PhishDestroy and ScamSniffer, confirming community consensus that the domain is being used for malicious purposes. The combination of a brand‑specific page title, recent registration, lack of encryption, and placement on multiple anti‑phishing repositories aligns with the “Crypto Scam” label in the intelligence brief.

Given the available evidence, defenders should immediately add hyperswep.com to network‑level deny lists and configure email gateways to block references to the domain. Continuous monitoring of the associated IP address and the registrar’s name‑server entries is advised, as the infrastructure may be repurposed for future campaigns. Where possible, security platforms should ingest the blocklist identifiers from PhishDestroy and ScamSniffer to accelerate detection.