get-started-hyperliquid[.]pages[.]dev

PhishDestroy identifies the domain get-started-hyperliquid.pages.dev as a live crypto drainer impersonating the legitimate Hyperliquid platform. This fraudulent site mimics Hyperliquid’s branding to deceive users into connecting crypto wallets or entering credentials, enabling unauthorized asset transfers. The threat is active and under investigation, with confirmed infrastructure hosted at 172.66.46.250 via Cloudflare’s proxy service. Users who engage with this domain risk wallet draining or credential theft, making immediate verification essential. This domain was flagged with zero detections on VirusTotal (1/95 engines), despite its active phishing campaign. Registered through Cloudflare, Inc., it leverages a Google Trust Services SSL certificate to appear legitimate. The impersonation of Hyperliquid— a well-known decentralized exchange— amplifies the risk, as victims may unknowingly expose wallets or sensitive data. PhishDestroy’s investigation confirms the threat is ongoing, requiring urgent user awareness and blocking. If you visited get-started-hyperliquid.pages.dev, disconnect your wallet immediately, revoke any granted permissions, and run a security scan using PhishDestroy’s tools. Do not enter credentials or connect wallets to unverified domains. Report the domain to Hyperliquid’s official support channels and monitor your wallet for unauthorized transactions. Stay vigilant: always verify URLs against official sources before interacting with crypto platforms. PhishDestroy’s seed 272984 flags this as a high-risk crypto drainer.