Is votes-hyperswaps-com.pages.dev a scam? TrustSniffer's high-risk assessment: 25/100

Overview

This website is a minimal single-page site titled "Hyperswap", published on a free shared-hosting subdomain whose hyphenated name reads like a "votes" page for a "hyperswaps" crypto-exchange brand. It presents only a very short block of text to a visitor, and its apparent purpose is to pose as, or ride on, a decentralized token-swap service.

Scam/Impersonation Risk

The evidence converges on an elevated risk of deceptive or malicious use. Two independent threat-intelligence detections classify the site as malicious and two more as suspicious, and an external blacklist corroborates these detections. A confirmed blacklist association is therefore present. The domain is a hyphenated, brand-like label on a shared hosting platform. This is a common construction for lookalike and campaign pages. No specific brand impersonation was confirmed, and no conflicting legal identities appear, so the concern rests on the blacklist and detection record. Behavioural testing was less alarming. Across three successful runs, no wallet-connection prompts, wallet-drainer behaviour, clipboard tampering, hidden forms, external password forms or content cloaking were observed. The page did generate a heavy volume of calls to outside services, including several to destinations outside the expected set, and recorded repeated browser console errors. That pattern suits a thin front-end that loads content or tracking from elsewhere. It does not on its own show harm, and it does not offset the threat detections. Evidence:

• Homepage: the visible text is minimal and titled "Hyperswap", with no products, terms or company description.
• Threat-intelligence reputation: two malicious and two suspicious detections, plus an external blacklist listing, against the site's hosting subdomain.
• Behavioural sandbox on the homepage: 15 external fetch requests and 3 external POST requests, 3 of them to non-allowlisted destinations, and 6 console errors; no wallet, clipboard or cloaking abuse.
• Domain provenance: registered in 2026 (~0.3 years old), with 1 archive snapshot (2026, first and last seen 2026-07-09; 1 year tracked).

Regulatory Verification Notes

The site exposes no legal, about, licensing or terms pages that could establish who operates it. On-page disclosure is unclear, and ownership and governance are opaque. The operator's real-world identity therefore remains unverified. No regulatory registration is evidenced, and no third-party broker record matched the site. The valid encryption certificate and the identifiable hosting network are baseline hygiene that any new site can obtain. They carry no weight as evidence of legitimacy or of an authorised financial service. The name suggests a swap or trading service, which would ordinarily sit within a financial-services licensing perimeter. The site presents no authorisation, entity name or jurisdiction. Evidence:

• Homepage: no company name, licence number, jurisdiction or legal notice is presented.
• Site structure: no terms, privacy or about pages were captured; the page content is only a few hundred characters.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 (DV), valid to 2026-12-05.

What to Verify Next

Any dealings should be held until the legitimate, official presence of the Hyperswap service is identified through an independent route, such as a project's own verified social accounts or a reputable aggregator. It should then be confirmed whether this address is an official property of that service. Any claim of authorisation should be tested against the relevant financial regulator's public register, and the official support channels should be confirmed independently rather than through this site. Suspected misuse should be reported to the hosting platform's abuse process and to the brand owner. Evidence:

• Homepage: it carries no verifiable entity or licence claim to check against a registry.
• Domain construction: the hosting subdomain name embeds the brand-like terms, which can be compared with the official domain of the genuine service.
• Reputation record: the blacklist and detection hits suggest a check of the platform's abuse process.

Summary Verdict

The site carries a high-risk, cautionary posture. Confirmed blacklist and threat-detection listings dominate the assessment, and the very recent origin, thin content and unconfirmed operator identity give no counterweight. The technical hygiene that is present does not outweigh the reputational evidence.

Infrastructure Integrity

The site is served through Cloudflare's CDN/WAF, and all four observed addresses are edge servers in the US network AS13335, with no origin server visible. This is a mitigating factor only. It shows that mainstream protective infrastructure fronts the site, but it hides the underlying host and makes it harder to verify independently or to notice a rapid content swap. It cannot offset the reputation risk.

Closing Assessment

Account login, credential entry, wallet connection and any payment or token transaction should be avoided. At most, the page should be viewed passively, and only from an isolated, non-sensitive browser environment.