hyperliq[.]xyz

PhishDestroy identifies hyperliq.xyz as an active high-risk brand impersonation domain masquerading as Hyperliquid. This threat specifically targets cryptocurrency traders by exploiting brand trust to deploy crypto drainers or harvest credentials. Impersonation of reputable DeFi platforms like Hyperliquid remains a favored tactic among threat actors seeking to divert transaction flows or steal private keys. This domain was flagged by 3 out of 95 VirusTotal security vendors and is registered through Dynadot LLC. It resolves to IP 54.215.31.113 and remains active as of the latest scan. While no public blocklist inclusion data was available at time of reporting, behavioral indicators suggest this domain is part of a coordinated campaign targeting Hyperliquid users. Trust scores for the domain and associated infrastructure are uniformly low, reflecting its malicious intent. Users are advised to refrain from interacting with hyperliq.xyz or any derivative domains. Verify URLs via official Hyperliquid channels before inputting credentials or initiating transactions. Report suspicious domains to Hyperliquid’s security team and local cybercrime units. Block the IP 54.215.31.113 at the network perimeter where feasible. Exercise heightened scrutiny when clicking links in unsolicited messages or social media posts referencing Hyperliquid.