trusted-hyperliquid-wallet[.]pages[.]dev

PhishDestroy identifies trusted-hyperliquid-wallet.pages.dev as an active crypto brand impersonation site targeting the Hyperliquid ecosystem. This domain leverages the Hyperliquid name to deceive users into connecting wallets or entering credentials, with the primary threat being cryptocurrency theft via drainer scripts. The risk level is currently marked as under_investigation, but the intent and infrastructure suggest a high potential for financial harm to visitors.

This domain was flagged for brand impersonation targeting Hyperliquid. Published threat intelligence includes zero detections on VirusTotal (0/95), registration via Cloudflare, Inc., and resolution to IP 188.114.96.3. The site holds an SSL certificate issued by Google Trust Services, indicating basic encryption but not legitimacy. No current presence on major blocklists was observed at the time of analysis. The domain appears to be using Cloudflare Pages, a legitimate platform, to host its impersonation content, which increases its deceptive potential.

To mitigate exposure, users should block access to trusted-hyperliquid-wallet.pages.dev at the network level and avoid interacting with any site claiming to be Hyperliquid unless directly linked from the official hyperliquid.io domain. Wallets should never be connected to third-party domains, especially those impersonating established crypto platforms. Report this domain to Hyperliquid’s official security channels and update browser blocklists accordingly. Always verify URLs via official social media or documentation before engaging.