hyperliquide-xyz[.]pages[.]dev

PhishDestroy identifies hyperliquide-xyz.pages.dev as an active brand-impersonation domain targeting Hyperliquid users. The site currently presents a high-fidelity replica of the legitimate Hyperliquid interface to harvest login credentials and session tokens, and is being tracked as active within PhishDestroy’s seed-indexed database under unique seed 649017.

This domain was flagged by 1 of 95 VirusTotal vendors at the time of analysis, indicating it remains undetected by most AV engines. It is registered through Cloudflare, Inc., resolves to IP 188.114.97.3, and relies on a Google Trust Services SSL certificate to appear legitimate. Despite zero detections on VirusTotal and no presence on public blocklists, the domain exhibits classic brand-impersonation hallmarks and is actively monitored for evolving payloads or redirections.

Current status is active, with no evidence of takedown as of the latest scan. Users should avoid accessing hyperliquide-xyz.pages.dev or entering any credentials. Security teams are advised to block the domain at DNS and firewall levels, and to report the URL to Hyperliquid’s abuse team and PhishDestroy via the seed-tagged submission portal. Continuous monitoring is recommended due to the low vendor detection rate and the potential for rapid infrastructure changes.