hyperliquued-en-xyz[.]pages[.]dev

PhishDestroy identifies hyperliquued-en-xyz.pages.dev as an active crypto-draining phishing site hosted behind Cloudflare on IP 188.114.96.3. This page masquerades as a liquidity or rewards portal to trick users into connecting crypto wallets, after which an embedded drainer silently transfers tokens to attacker-controlled addresses. No current antivirus engine (1/95 on VirusTotal) has flagged the payload, so infections can occur before signatures exist. This domain was flagged on seed b51a90 and uses a Google Trust Services SSL certificate to appear legitimate. The pages.dev subdomain indicates a Cloudflare Pages deployment, a favored tactic among phishing actors because Cloudflare’s free tier and reverse proxy make takedown slower and harder to trace. Registrar data shows the site went live within the last 48 hours, which aligns with the rapid rise of crypto drainers targeting new liquidity pools or airdrops. If you visited hyperliquued-en-xyz.pages.dev, immediately revoke any wallet connections in your browser settings or wallet software. Transfer remaining assets to a fresh wallet with a new seed phrase, enable hardware-wallet signing for future transactions, and run a malware scan on the device. Report the domain to PhishDestroy so our crawlers can extract the drainer payload and update detection rules for antivirus vendors.