hyperliquid-xyz-eng[.]pages[.]dev

Domain hyperliquid-xyz-eng.pages.dev has been flagged for active brand impersonation targeting Hyperliquid, a decentralized exchange platform. The domain leverages Cloudflare Pages to host a fraudulent replica of Hyperliquid’s interface, likely intended to harvest credentials or facilitate crypto drainer operations. No drainer kit artifacts were observed in initial analysis, but the threat actor’s use of a legitimate-looking subdomain (hyperliquid-xyz-eng) suggests a deliberate effort to exploit user trust in the brand. Technical indicators reveal a concerning lack of detection, with VirusTotal currently scoring 0/95 despite the domain’s malicious intent. The domain was registered through Cloudflare, Inc., resolving to IP 188.114.97.3 and protected by a Google Trust Services SSL certificate. While the exact creation date is unverified, the domain’s active status and infrastructure alignment with known impersonation tactics warrant immediate scrutiny. PhishDestroy identifies this domain as active and under investigation, with current risk assessed as elevated due to the absence of detection and brand targeting. Users are advised to block the domain at the network level and report it to Hyperliquid’s security team. Remaining risk hinges on the actor’s ability to evade detection longer, emphasizing the need for proactive monitoring and takedown efforts.