auth-hyperliquid-exchangee-en-us[.]pages[.]dev

PhishDestroy has identified auth-hyperliquid-exchangee-en-us.pages.dev as a brand impersonation threat targeting Hyperliquid, a popular crypto exchange. The domain was created on April 12, 2026, and registered through Cloudflare, Inc. This site attempts to trick users into revealing their login credentials by presenting a page titled "Hyperliquid Exchange – Secure & Transparent Crypto Trading." No specific drainer kit has been associated with this domain at this time, but its sole purpose is clearly malicious.

Technical analysis reveals that the domain resolves to IP address 188.114.97.3 and uses an SSL certificate issued by Google Trust Services (WE1). VirusTotal reports zero detections out of 95 security vendors, meaning it has not yet been flagged by antivirus engines. However, it already appears on one security blocklist, and Google Safe Browsing has not yet listed it as dangerous. The domain's registration through Cloudflare and its recent creation date are consistent with phishing infrastructure designed to evade initial detection.

Currently, the domain has been taken offline, which is a positive development. PhishDestroy has flagged this domain for further investigation and recommends that users always verify URLs before entering sensitive information. Users should only access Hyperliquid through the official website and never through unsolicited links. While the immediate threat is neutralized, similar domains may arise, so continued vigilance is advised. Always double-check domain names for subtle misspellings or extra hyphens, as seen here with "hyperliquid-exchangee" instead of the legitimate "hyperliquid."