exchange-hyperliquid-eng-us[.]pages[.]dev

PhishDestroy identifies exchange-hyperliquid-eng-us.pages.dev as a high-risk brand impersonation site targeting Hyperliquid users. This domain masquerades as the legitimate exchange to trick visitors into revealing passwords, wallet keys, or transfer funds to attacker-controlled wallets. Crafted to deceive even vigilant users, it leverages Cloudflare Pages hosting and a Google Trust Services SSL certificate to appear authentic while hosting malicious copycat pages designed to harvest sensitive information. PhishDestroy’s analysis confirms this domain was registered through Cloudflare, Inc. and currently shows 1 out of 95 VirusTotal detections as of the latest scan—indicating it evades most automated detection systems. It resolves to IP address 172.66.47.106 and was flagged due to its exact replication of Hyperliquid’s branding, interface, and domain structure (exchange-hyperliquid-eng-us.pages.dev), a clear tactic used in credential phishing and cryptocurrency theft campaigns. The use of Cloudflare Pages and a legitimate SSL certificate demonstrates sophisticated evasion tactics commonly used by advanced phishing actors. If you visited this site, DO NOT enter any credentials, connect a wallet, or transfer funds. Immediately close the browser, clear site data, and run a malware scan on your device. Report the domain to Hyperliquid’s official support channel and share the URL with PhishDestroy for further analysis. Always verify the domain by comparing it to the official Hyperliquid website (hyperliquid.xyz) and avoid clicking links from emails, social media, or ads—even if they appear legitimate. Use multi-factor authentication and hardware wallets to protect your assets when trading cryptocurrency.