app-hyperliquidxyz[.]pages[.]dev

This domain, app-hyperliquidxyz.pages.dev, is currently active and engaged in brand impersonation targeting Hyperliquid, a known cryptocurrency platform. Analysis indicates the domain is designed to deceive users by mimicking the legitimate Hyperliquid brand, potentially facilitating fraudulent activities such as unauthorized transactions or credential harvesting. The page title, 'Hyperliquid XYZ: explained - Your Hub to the Hyperliquid,' reinforces the attempt to appear as an official or affiliated resource, increasing the likelihood of user deception. Infrastructure analysis reveals the domain was registered on March 22, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, hosted under Cloudflare’s network in Canada. Security vendors on VirusTotal have flagged this domain, with 6 out of 95 engines identifying it as malicious. The domain appears on one security blocklist, specifically PhishDestroy, further corroborating its high-risk classification. The SSL certificate is issued by Google Trust Services, using the WE1 intermediate, which while common for legitimate services, does not mitigate the underlying threat posed by the domain’s intent. At present, app-hyperliquidxyz.pages.dev remains active and continues to host content impersonating Hyperliquid. Organizations and users are advised to block this domain at the network level and monitor for any attempts to access it within their environments. Security teams should update detection rules to include this domain and its associated IP address as indicators of compromise. Users encountering this domain should avoid interaction, refrain from entering any credentials or sensitive information, and report the site to relevant security platforms for further analysis and takedown efforts.