xyz-hypperliqued-access[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting Hyperliquid, a decentralized exchange platform. The site presents itself as an official Hyperliquid portal under the title 'Hyperliquid ® XYZ | Advanced Decentralized Exchange Platform,' likely designed to deceive users into disclosing credentials, wallet keys, or other sensitive financial information. The infrastructure mimics legitimate exchange interfaces, increasing the likelihood of successful social engineering attacks against cryptocurrency users and traders. Analysis indicates the domain was registered on April 30, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, geolocated to Canada under Cloudflare’s network. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging Cloudflare services. VirusTotal reports 1 out of 95 security vendors flagging this domain as malicious, while PhishDestroy has explicitly blocked it. Additionally, the domain appears on one security blocklist, suggesting early but limited detection across threat intelligence platforms. Users who have visited xyz-hypperliqued-access.pages.dev should assume potential exposure of sensitive data. Immediate actions include revoking any active sessions, rotating credentials for Hyperliquid or associated accounts, and monitoring for unauthorized transactions. Wallet holders should transfer assets to a new secure wallet and review connected dApp permissions. System scans for malware are recommended, particularly if files were downloaded or browser extensions were installed. Organizations should update internal blocklists to include this domain and its resolving IP address to prevent further access attempts.