hyprliquid--exchange[.]pages[.]dev

PhishDestroy identifies hyprliquid--exchange.pages.dev as a brand-impersonation domain targeting Hyperliquid users with a suspected cryptocurrency drainer kit. The infrastructure is hosted on Cloudflare Pages and resolves to IP 188.114.96.3, which is currently associated with a Google Trust Services SSL certificate. No malicious payload signatures have been uploaded to VirusTotal as of the latest scan, leaving the site undetected by 95 engines. This domain was flagged under seed 139116 with a VirusTotal detection score of 1/95, registered through Cloudflare, Inc., and currently carries a clean status on Google Safe Browsing. The site remains active and unlisted on major blocklists, maintaining a low public profile while posing a direct threat to Hyperliquid traders seeking liquidity solutions. The risk remains ACTIVE and under investigation. Users are advised to avoid all connections to hyprliquid--exchange.pages.dev, verify Hyperliquid endpoints via official channels only, and report any encounter to PhishDestroy for takedown action. Blocking the IP 188.114.96.3 at the network perimeter is also recommended to mitigate potential exposure.