zilla-4u5[.]pages[.]dev

The domain zilla-4u5.pages.dev poses a significant threat by impersonating the cryptocurrency brand Hyperliquid. Detected by PhishDestroy on February 26, 2026, this domain has already been flagged by one vendor on VirusTotal and is listed on two public blocklists, including PhishDestroy and ScamSniffer. Hosted on IP 172.66.45.33 in the US and registered with Cloudflare, Inc., the site uses an SSL certificate issued by Google Trust Services.

This phishing operation exploits the allure of cryptocurrency investments to deceive users into divulging sensitive information or transferring funds. The domain's platform risk score of 76 out of 100 indicates a high level of threat. Despite its recent creation on July 19, 2025, the domain has quickly gained notoriety in the cybersecurity community.

The use of Cloudflare's infrastructure and a Google-issued SSL certificate lends a veneer of legitimacy to the operation, potentially lulling victims into a false sense of security. The swift detection and flagging by PhishDestroy highlight the importance of early identification in combating such threats. With only one detection on VirusTotal, the domain exemplifies how phishing sites can operate under the radar, exploiting the gap between domain registration and antivirus database updates.