secure-hyperliquedd-exchange[.]pages[.]dev

PhishDestroy identifies secure-hyperliquedd-exchange.pages.dev as an active brand impersonation threat targeting Hyperliquid users. This domain mimics the legitimate Hyperliquid exchange to deceive visitors into entering sensitive credentials or transferring cryptocurrency. The fraudulent site currently shows zero detections across 95 security engines on VirusTotal, suggesting it has evaded initial detection mechanisms. Registered through Cloudflare, Inc., this page resolves to IP address 188.114.96.3 and utilizes a Google Trust Services SSL certificate to appear legitimate. This threat analysis reveals a sophisticated impersonation scheme designed to exploit trust in the Hyperliquid brand. The attackers leverage Cloudflare's Pages.dev platform to host their fraudulent content, which explains the recent appearance of this domain. The complete lack of detections (2/95) indicates this campaign is either very new or has implemented evasion techniques to bypass security measures. The use of a legitimate SSL certificate from Google Trust Services further enhances the site's credibility, making it more convincing to potential victims. If you've visited secure-hyperliquedd-exchange.pages.dev, immediately cease any interaction with the site and disconnect from any connected wallets or accounts. Check your browser history for any saved credentials related to Hyperliquid and revoke them immediately. Monitor your cryptocurrency wallets for unauthorized transactions and consider enabling two-factor authentication on all related accounts. Report this domain to your security team or through PhishDestroy's reporting channels to help prevent further victimization. Always verify the authenticity of cryptocurrency exchange websites by checking official sources and confirming the correct domain structure before entering any sensitive information.