# PhishDestroy threat dossier — support-cdn-hyperliuid-xyz.pages.dev ================================================================ Fetched: 2026-05-03 12:53:32 UTC Canonical: https://phishdestroy.io/domain/support-cdn-hyperliuid-xyz.pages.dev/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 91/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Hyperliquid ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 1/91 security vendors flagged this domain Flagging vendors: LevelBlue ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.97.3 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: CloudFlare, Inc. Registrar: Cloudflare, Inc. Nameservers: gwen.ns.cloudflare.com, patryk.ns.cloudflare.com Registered: 2026-05-01 Page title: Hyperliquid XYZ | Deep Liquidity, Fast Execution, Next-Level Trading HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-07-07 Status: INVALID chain Fingerprint: b134d43bc2aad4d5a182245c7a5bcb2ae0f74480c397fc46572a8b15769c8ad4 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-05-01 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-01 02:33:37 UTC (by PhishDestroy tracker) Last verified: 2026-05-01 13:02:30 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019de0bb-2cf0-70cf-a9e9-93c91cde31a2/ Wayback Machine: https://web.archive.org/web/*/support-cdn-hyperliuid-xyz.pages.dev crt.sh CT logs: https://crt.sh/?q=%25.support-cdn-hyperliuid-xyz.pages.dev Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=support-cdn-hyperliuid-xyz.pages.dev AlienVault OTX: https://otx.alienvault.com/indicator/domain/support-cdn-hyperliuid-xyz.pages.dev URLhaus: https://urlhaus.abuse.ch/host/support-cdn-hyperliuid-xyz.pages.dev/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-05-01 02:35:16 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies support-cdn-hyperliuid-xyz.pages.dev as a malicious domain engaged in brand impersonation, specifically targeting Hyperliquid, a well-known crypto trading platform. The domain employs deceptive naming conventions to mimic official Hyperliquid infrastructure, leveraging the 'Hyperliquid XYZ' page title and 'support-cdn' prefix to appear legitimate. While no explicit drainer kit details are provided in available intelligence, the page title suggests a focus on luring users with promises of 'Deep Liquidity, Fast Execution, Next-Level Trading,' a common tactic in crypto-related fraud to exploit trust in established brands. The domain resolves to a single IP address, 188.114.97.3, and is hosted on Cloudflare’s infrastructure via Cloudflare Pages. SSL certification is provided by Google Trust Services, potentially adding a veneer of legitimacy. As of current telemetry, the domain has a VirusTotal detection ratio of 1 out of 95 security vendors, indicating low but present recognition of its malicious nature. No specific creation date is available, though the domain remains actively accessible. Google Safe Browsing (GSB) has not flagged the domain, and no blocklist counts are provided in the data. These factors suggest a recently deployed or carefully evasive campaign. This domain remains in active status, with no signs of takedown at the time of analysis. Immediate action is advised, including network-level blocking of the domain and IP address to prevent further access. Users should be warned against interacting with any links or content associated with this domain, particularly in crypto trading contexts. The remaining risk is high due to the domain’s active status, the impersonation of a major crypto brand, and the lack of broad detection coverage. Proactive hunting for related infrastructure and user awareness campaigns are strongly recommended to mitigate potential exposure. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: b134d43bc2aad4d5a182245c7a5bcb2ae0f74480c397fc46572a8b15769c8ad4 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/support-cdn-hyperliuid-xyz.pages.dev/ JSON API: https://api.destroy.tools/v1/check?domain=support-cdn-hyperliuid-xyz.pages.dev Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 145,158 domains (55,994 alive under monitoring, 88,742 confirmed takedowns/dead). Site: https://phishdestroy.io