hyperliquid-xchang-setup[.]pages[.]dev

Analysis indicates that the domain hyperliquid-xchang-setup.pages.dev is actively impersonating Hyperliquid, a cryptocurrency trading platform, as of July 12, 2026. The domain resolves to IP address 188.114.96.3, which is associated with Cloudflare, Inc. and geolocated in Canada. Infrastructure analysis reveals registration through Cloudflare, with nameservers romina.ns.cloudflare.com and valentin.ns.cloudflare.com. The domain was created on October 15, 2025, and remains operational with an HTTP 200 status. The page title, 'Hyperliquid (HYPE): The Future of On-Chain Trading,' explicitly references the targeted brand, confirming the intent to deceive users familiar with Hyperliquid's services. The domain appears on one security blocklist, specifically PhishDestroy, which classifies it as a brand impersonation scam. Gridinsoft assigns a trust score of 0/100, further signaling high risk. While 91 vendors have scanned the domain on VirusTotal, none currently flag it as malicious; however, the absence of detections does not confirm safety. The SSL certificate is issued by Google Trust Services, a common practice among both legitimate and malicious domains leveraging Cloudflare's infrastructure. Defenders should treat this domain as an active threat targeting Hyperliquid users. Given its registration under Cloudflare Pages and the use of a reputable SSL certificate, the domain may evade initial automated detection. Monitoring for connections to 188.114.96.3 or the domain itself in network logs is recommended. If the domain is encountered in user reports or internal telemetry, immediate blocking and further investigation into associated accounts or transactions are advised. The exact content and functionality of the site remain unanalyzed, but the combination of brand impersonation, low trust scores, and blocklist inclusion warrants proactive mitigation.