net-en-hyperliquid-wallet[.]pages[.]dev

PhishDestroy identifies net-en-hyperliquid-wallet.pages.dev as an active brand impersonation domain targeting Hyperliquid users. This fraudulent site leverages Cloudflare’s Pages.dev platform to mimic Hyperliquid’s official branding, creating a high-risk deception vector for cryptocurrency enthusiasts seeking wallet services. The domain’s deceptive appearance—particularly its use of “Hyperliquid” in its subdomain—is designed to trick users into entering sensitive credentials or transferring funds to attacker-controlled addresses.

Technical indicators confirm this domain’s malicious nature. VirusTotal analysis shows 3 of 95 security vendors flagged the site, indicating a moderate but significant threat level. Registered through Cloudflare, Inc., the domain resolves to IP 188.114.96.3 and is secured with a Google Trust Services SSL certificate, which attackers often exploit to appear legitimate. The combination of a trusted certificate authority, cloud hosting, and impersonation tactics amplifies the risk of credential theft or financial fraud.

Users who visited this domain should immediately cease interaction and audit their Hyperliquid accounts for unauthorized activity. Enable multi-factor authentication (MFA) if not already active, and revoke any session tokens or API keys exposed during the visit. Report the domain to Hyperliquid’s official support channels and consider running a malware scan on local devices. To avoid similar threats, always verify domains via Hyperliquid’s official website (hyperliquid.xyz) and cross-check SSL certificates for anomalies.