claim-hyperliquid[.]info

The domain claim-hyperliquid.info is a phishing site engaged in brand impersonation targeting Hyperliquid, a cryptocurrency platform. It was designed to deceive users into believing they were interacting with the legitimate Hyperliquid brand, likely to harvest sensitive information or facilitate cryptocurrency scams. No drainer kit was identified, but the site posed an elevated risk due to its fraudulent nature. As of the latest verification, claim-hyperliquid.info has been taken offline.

Technical indicators confirm the malicious intent of claim-hyperliquid.info. The domain was flagged by 3 of 95 security vendors on VirusTotal, including Fortinet, Gridinsoft, and SOCRadar. It appeared on 3 security blocklists, specifically PhishDestroy, MetaMask, and SEAL. Registered through NiceNIC International Group Co., Limited, the domain was created on February 21, 2026, and resolved to the IP address 104.21.40.253, hosted by Cloudflare in the US. The SSL certificate was issued by Google Trust Services (WE1), and the observed page title was 'Just a moment...'. Technologies detected included HSTS, Cloudflare Browser Insights, and HTTP/3.

Users who interacted with claim-hyperliquid.info should take immediate safety steps. If cryptocurrency transactions were attempted, revoke any token approvals and transfer remaining funds to a new wallet. If login credentials were entered, change passwords immediately and enable two-factor authentication (2FA) on all related accounts. Monitor accounts for unauthorized activity and report the phishing domain to platforms like Google Safe Browsing, PhishTank, or the impersonated brand’s official security team for further action.