home-wallet-hyperliquid[.]pages[.]dev

This domain, home-wallet-hyperliquid.pages.dev, is flagged for brand impersonation targeting Across, a decentralized finance protocol. The site presents itself as a Hyperliquid Wallet with the page title 'Hyperliquid Wallet — Secure, Fast, Multi-Dimensional,' designed to deceive users into interacting with fraudulent wallet interfaces. Analysis indicates no direct evidence of a drainer kit at this stage, but the domain exhibits characteristics consistent with credential harvesting or wallet seed phrase collection schemes targeting cryptocurrency users.

Technical indicators reveal the domain was registered on October 16, 2025, through Cloudflare, Inc., and resolves to the IPv6 address 2606:4700:310c::ac42:2f8d, hosted on Cloudflare’s infrastructure (AS13335). VirusTotal currently reports 0/95 detections, indicating no antivirus engines have flagged the domain as malicious. The SSL certificate is issued by Google Trust Services (WE1), a common certificate authority for legitimate and malicious sites alike. As of this report, the domain appears on one security blocklist, suggesting early but limited detection within the threat intelligence community.

The domain remains active and accessible, with no takedown or sinkholing observed. Response actions by security teams are ongoing, including monitoring for changes in detection status or additional blocklist inclusions. Users are advised to treat this domain as high-risk for financial fraud, particularly those interacting with Across or Hyperliquid-related services. Organizations should update web filters to block access to home-wallet-hyperliquid.pages.dev and monitor for similar impersonation domains leveraging Cloudflare Pages infrastructure. Immediate verification of wallet addresses and transaction destinations is recommended for any user who may have engaged with this site.