hyperliquid-exchangee-en-us[.]pages[.]dev

This domain, hyperliquid-exchangee-en-us.pages.dev, is confirmed to engage in brand impersonation targeting Hyperliquid, a cryptocurrency exchange platform. Analysis indicates the site mimics legitimate trading interfaces, presenting itself under the page title 'Hyperliquid Exchange — Fast, Secure Crypto Trading.' The infrastructure is designed to deceive users into interacting with fraudulent trading portals, likely facilitating unauthorized transactions or credential harvesting. No direct evidence of a crypto drainer kit was observed, but the domain's structure and branding align with known impersonation tactics used in cryptocurrency scams. Infrastructure analysis reveals the following technical indicators: the domain was registered on February 21, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.46.249, hosted on AS13335 (Cloudflare, Inc.). The SSL certificate is issued by Google Trust Services (WE1). Detection metrics show the domain is flagged by 1 out of 95 security vendors on VirusTotal and appears on one security blocklist. The domain is not currently listed on Google Safe Browsing, which may contribute to its continued accessibility. The domain remains active as of the latest verification, with no takedown or mitigation measures observed. Users are advised to block the domain at the network level and monitor for related indicators of compromise, including the IP address 172.66.46.249 and the SSL certificate issuer. Organizations should update their detection rules to include this domain and its associated infrastructure, particularly in environments where cryptocurrency-related activities are conducted. The risk level remains high due to the domain's active status and its direct targeting of cryptocurrency users through brand impersonation.