support-cdn-hyperliuid-xyz[.]pages[.]dev

PhishDestroy identifies support-cdn-hyperliuid-xyz.pages.dev as a malicious domain engaged in brand impersonation, specifically targeting Hyperliquid, a well-known crypto trading platform. The domain employs deceptive naming conventions to mimic official Hyperliquid infrastructure, leveraging the 'Hyperliquid XYZ' page title and 'support-cdn' prefix to appear legitimate. While no explicit drainer kit details are provided in available intelligence, the page title suggests a focus on luring users with promises of 'Deep Liquidity, Fast Execution, Next-Level Trading,' a common tactic in crypto-related fraud to exploit trust in established brands. The domain resolves to a single IP address, 188.114.97.3, and is hosted on Cloudflare’s infrastructure via Cloudflare Pages. SSL certification is provided by Google Trust Services, potentially adding a veneer of legitimacy. As of current telemetry, the domain has a VirusTotal detection ratio of 1 out of 95 security vendors, indicating low but present recognition of its malicious nature. No specific creation date is available, though the domain remains actively accessible. Google Safe Browsing (GSB) has not flagged the domain, and no blocklist counts are provided in the data. These factors suggest a recently deployed or carefully evasive campaign. This domain remains in active status, with no signs of takedown at the time of analysis. Immediate action is advised, including network-level blocking of the domain and IP address to prevent further access. Users should be warned against interacting with any links or content associated with this domain, particularly in crypto trading contexts. The remaining risk is high due to the domain’s active status, the impersonation of a major crypto brand, and the lack of broad detection coverage. Proactive hunting for related infrastructure and user awareness campaigns are strongly recommended to mitigate potential exposure.