faq-hyperliquid-exchange-io-us[.]pages[.]dev

The domain faq-hyperliquid-exchange-io-us.pages.dev was created on 13 October 2025 and is currently taken offline, returning HTTP 403 responses. It resolves to the Cloudflare edge address 172.66.46.225 (AS13335, United States) and presents a Google Trust Services SSL certificate issued by the WE1 intermediate, indicating standard Cloudflare TLS termination. Google Safe Browsing has classified the site under social engineering, and 11 of 95 security vendors on VirusTotal have flagged the domain as malicious, reflecting a consensus of threat detection across multiple engines. The registrar information shows the domain was registered through Cloudflare, Inc., and its authoritative nameservers are anna.ns.cloudflare.com and cody.ns.cloudflare.com, both standard Cloudflare DNS endpoints.

The page title captured from the site reads "Hyperliquid Exchange — Fast, Liquid, Professional Crypto Trading," suggesting an attempt to mimic a legitimate cryptocurrency trading platform. However, the intelligence set lists the impersonated brand as "across," indicating that the malicious operators may be targeting users of the Across brand while leveraging the Hyperliquid branding for credibility. The site is listed on at least one public blocklist, with PhishDestroy confirming the domain as a malicious entry. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low credibility assessment.

Detected technologies include HTTP/3, HSTS, and Cloudflare infrastructure, all typical of fast‑hosted malicious pages. Because the site is offline, live content, login forms, or additional payloads could not be examined, leaving the exact phishing workflow uncertain. Defenders should immediately block the domain and its associated IP address in perimeter firewalls and DNS filtering solutions, add the domain to internal threat intel feeds, and monitor for any new subdomains or similarly structured URLs leveraging the same Cloudflare nameservers.