hyperliquid-ex--change[.]pages[.]dev

PhishDestroy identifies hyperliquid-ex--change.pages.dev as a confirmed brand impersonation site currently under investigation. The domain poses a specific threat by mimicking the Hyperliquid Exchange brand to deceive users into revealing sensitive information such as login credentials or cryptocurrency wallet details. The site remains active, targeting users of the Across platform with a fraudulent decentralized perpetual trading interface.

Technical analysis reveals that the domain was registered through Cloudflare, Inc. on October 16, 2025, and resolves to IP address 188.114.97.3. It utilizes an SSL certificate issued by Google Trust Services / WE1, lending a false sense of security. VirusTotal analysis shows 0 out of 95 vendors have flagged the domain, indicating it has not yet been widely detected by security tools. However, it already appears on 1 security blocklist, suggesting early identification by threat intelligence sources. The page title, "Hyperliquid Exchange — Decentralized Perpetual Trading," is a direct copy of the legitimate brand, further confirming the impersonation.

Given its active status and lack of widespread detection, users are strongly advised to avoid interacting with hyperliquid-ex--change.pages.dev entirely. Do not enter any personal, financial, or wallet information on this site. If you have already done so, change your credentials immediately and monitor your accounts for suspicious activity. Report the domain to relevant authorities and security vendors to help accelerate its inclusion on blocklists.