hyperliquied-xyz-eng[.]pages[.]dev

The domain hyperliquied-xyz-eng.pages.dev was registered on April 05 2026 through Cloudflare, Inc. and resolves to the Cloudflare IP 188.114.97.3 located in Canada. The authoritative nameservers are brenda.ns.cloudflare.com and hank.ns.cloudflare.com. The site presents an HTTPS certificate issued by Google Trust Services under the WE1 root, indicating a valid TLS configuration. HTTP requests return status 200 and the page title returned is “Hyperliquid® XYZ – Secure Crypto Exchange & Trading Platform,” directly referencing the Hyperliquid brand. The infrastructure is classified as a “Fake Exchange” impersonating Hyperliquid, and it has been added to at least one security blocklist, including PhishDestroy. VirusTotal analysis shows that 1 of 94 security vendors flagged the domain, while Gridinsoft assigns a trust score of 0/100, reflecting a high likelihood of malicious intent. Current evidence does not reveal the exact content or credential‑harvesting mechanisms employed, and no additional hosting or backend details are available. Defenders should block the domain and its associated IP, monitor DNS queries for the listed Cloudflare nameservers, and treat any traffic to this host as potentially fraudulent. Continued observation of threat‑intel feeds for new detections or changes in classification is recommended.