portal-hyperliiqued-xyz[.]pages[.]dev

PhishDestroy identifies portal-hyperliiqued-xyz.pages.dev as a live phishing domain impersonating a liquidity mining portal, currently under investigation for distributing malicious payloads. The domain leverages a Google Trust Services SSL certificate to appear legitimate while hosting fraudulent content designed to steal cryptocurrency credentials and funds. This domain was flagged by 0 of 95 VirusTotal vendors as of seed a9ef2b, resolving to IP 172.66.45.45 through Cloudflare, Inc. The registrar’s infrastructure, combined with the lack of current detections, underscores the camouflaged nature of this threat—evading automated detection while actively targeting financial users. Currently active but under review, portal-hyperliiqued-xyz.pages.dev poses an imminent risk to cryptocurrency users seeking liquidity opportunities. Users are advised to avoid accessing the domain entirely and report any interactions to their security teams. Security teams should block the domain at the network level and monitor for associated IP/C2 communications to prevent broader compromise.