hypurrbridge[.]pages[.]dev

This domain, hypurrbridge.pages.dev, is identified as a brand impersonation threat specifically targeting Hyperliquid, a decentralized perpetuals exchange. Analysis indicates the site was designed to mimic Hyperliquid’s legitimate interface, likely to facilitate crypto asset theft or unauthorized transactions. The page title explicitly matches the target brand, and the domain employs common frontend libraries such as SweetAlert2 and crypto-js, which are frequently abused in crypto drainer operations to simulate legitimate wallet interactions. Technical indicators confirm elevated risk: the domain is flagged by 12 out of 95 security vendors on VirusTotal, appears on two independent blocklists (PhishDestroy and ScamSniffer), and was registered through Cloudflare on November 30, 2024. It resolves to the IP address 188.114.96.3, a Cloudflare-hosted endpoint, and presents a Google Trust Services SSL certificate. The domain’s infrastructure includes HSTS and HTTP/3, suggesting an attempt to appear legitimate while leveraging content delivery networks (cdnjs, jsDelivr) to obscure malicious payloads. As of the latest assessment, hypurrbridge.pages.dev has been taken offline, reducing immediate exposure. However, the domain remains a residual risk due to its recent creation and prior malicious activity. Users who interacted with the site should revoke any connected wallet permissions, monitor transaction histories for unauthorized activity, and verify future communications against official Hyperliquid channels. Security teams should maintain blocklist entries and monitor for re-emergence under similar naming conventions or infrastructure.