new-hyperliquid-web3[.]pages[.]dev

This domain, new-hyperliquid-web3.pages.dev, is actively flagged as a high-risk brand impersonation threat targeting Hyperliquid, a decentralized exchange platform. Registered on April 30, 2026, through Cloudflare, Inc., the domain resolves to the IP address 172.66.47.121, hosted on Cloudflare infrastructure in Canada. Analysis of its nameservers (coen.ns.cloudflare.com and laura.ns.cloudflare.com) and SSL certificate issued by Google Trust Services (WE1) confirms its association with Cloudflare’s content delivery network, a common tactic to obscure hosting origins and evade immediate takedowns. The page title, 'Is Hyperliquid Safe? — 2024 Security Assessment & Risk Analysis,' suggests an attempt to deceive users by posing as a legitimate security evaluation of the Hyperliquid platform. While the exact content of the site remains unanalyzed, the combination of this title and the domain’s naming convention (incorporating 'hyperliquid' and 'web3') strongly indicates an intent to exploit trust in the Hyperliquid brand. The domain is currently active, returning an HTTP 200 status, and has been blocked by at least one security vendor (PhishDestroy). Additionally, two of 91 security vendors on VirusTotal have flagged the domain as malicious, though this detection rate remains low, potentially due to its recent registration or evasion techniques. Infrastructure analysis reveals the use of modern web technologies, including HTTP/3 and HTTP Strict Transport Security (HSTS), which may be leveraged to lend an appearance of legitimacy. The domain’s Gridinsoft trust score of 0/100 further corroborates its classification as a high-risk entity. Defenders are advised to treat this domain as a confirmed phishing resource targeting Hyperliquid users, particularly those seeking security-related information. Immediate blocking at the DNS or network level is recommended, along with monitoring for related domains utilizing similar naming patterns or Cloudflare-based hosting.