app-hyperliquid[.]pages[.]dev

This domain, app-hyperliquid.pages.dev, is actively hosting a phishing page designed to mimic legitimate cryptocurrency wallet login interfaces. The site specifically targets users of HyperLiquid-related services, attempting to harvest credentials, private keys, or seed phrases through fraudulent input forms. Infrastructure analysis reveals the use of Cloudflare hosting (AS13335) with a Google Trust Services SSL certificate (WE1), creating a false sense of legitimacy for potential victims. Evidence supporting the malicious classification includes its presence on one security blocklist, despite zero detections in VirusTotal's 95-engine scan (0/95). The domain resolves to IP address 188.114.96.3 and was registered through Cloudflare's domain services. While the exact creation date remains unconfirmed, the current active status and lack of widespread detection suggest this may be a recently deployed phishing operation designed to evade automated security systems. Users who have visited app-hyperliquid.pages.dev should immediately revoke any entered credentials and monitor associated cryptocurrency wallets for unauthorized transactions. If login details were submitted, affected parties should transfer assets to new wallets using fresh seed phrases and consider reporting the incident to relevant blockchain security teams. System administrators should add this domain to internal blocklists and monitor network traffic for connections to 188.114.96.3. The SSL certificate fingerprint (WE1) may serve as an additional indicator for detection rules.