en-net-hyperliquid-wallet[.]pages[.]dev

The domain en-net-hyperliquid-wallet.pages.dev was registered through Cloudflare, Inc. on April 30, 2026 and resolves to the Cloudflare‑owned address 172.66.47.169, which is geolocated to Canada. The authoritative nameservers are addilyn.ns.cloudflare.com and frank.ns.cloudflare.com. HTTPS is enforced via HSTS, the site serves HTTP/3, and the TLS certificate is issued by Google Trust Services under the WE1 label. The page title returned by the server is “How to Connect Your Wallet to Hyperliquid Exchange (Step‑by‑Step)”, indicating a brand‑impersonation campaign targeting Hyperliquid. The domain is currently active, classified as a brand impersonation threat, and listed on a single security blocklist. It is specifically blocked by PhishDestroy, and the Gridinsoft trust score is 0 out of 100. VirusTotal reports that the domain was scanned by 91 vendors with no detections at the time of analysis. While the available data confirms the use of legitimate CDN infrastructure and an unremarkable TLS configuration, the combination of a brand‑specific page title, low trust score, and blocklist presence suggests malicious intent. Uncertainties remain regarding the full content of the site, any credential‑harvesting mechanisms, and whether additional infrastructure is employed. Defenders should add the domain to network and email blocklists, monitor DNS queries for the associated IP and nameservers, and treat any traffic to the site as suspicious. Continuous observation is recommended to detect any changes in hosting, content, or detection status.