start-vertex-protocol[.]pages[.]dev

This domain, start-vertex-protocol.pages.dev, poses a significant credential theft risk by impersonating the Hyperliquid Wallet interface. Visitors are presented with a fraudulent DeFi asset management portal designed to harvest cryptocurrency wallet credentials, private keys, or recovery phrases. The site mimics legitimate wallet functionality, including transaction signing prompts, to deceive users into disclosing sensitive authentication details. Such phishing infrastructure is commonly used to drain digital assets from compromised wallets immediately after credential submission. Analysis indicates this domain was registered through Cloudflare Pages on April 27, 2026, and currently resolves to the IP address 172.66.47.2, hosted by Cloudflare in Canada. Security vendor detections on VirusTotal show 4 out of 95 engines flagging the domain as malicious, with one additional blocklist (PhishDestroy) actively blocking it. The SSL certificate, issued by Google Trust Services (WE1), provides encrypted connections but does not validate legitimacy. The page title, 'Hyperliquid Wallet | Secure & Fast DeFi Asset Management,' directly copies branding elements from the authentic Hyperliquid platform to enhance credibility. If this domain was visited, immediate action is required to mitigate potential asset loss. Users should disconnect any connected wallets from the site and revoke all associated dApp permissions using their wallet's settings interface. All credentials, including passwords, private keys, or seed phrases entered on the site, must be considered compromised and should never be reused. Affected wallets should be transferred to new, secure addresses with fresh recovery phrases. Monitoring for unauthorized transactions is critical, and any suspicious activity should be reported to the relevant blockchain explorer or security response teams for further investigation.