hypexsol[.]live

This domain, hypexsol.live, is identified as a brand impersonation phishing site targeting users of Hyperliquid, a decentralized exchange platform. The site presents itself as an official airdrop campaign, using the page title 'Hyperliquid l Airdrop' to deceive victims into interacting with malicious smart contracts or disclosing sensitive credentials. Infrastructure analysis reveals the use of modern web technologies, including Node.js, Vue.js, and Nuxt.js, alongside Cloudflare for hosting and DDoS protection, suggesting a well-constructed phishing kit designed to evade basic detection mechanisms. Technical indicators confirm the domain's malicious nature. hypexsol.live was registered on April 30, 2026, through Global Domain Group LLC, an entity frequently associated with high-risk domains. It resolves to the IP address 172.67.189.204, a Cloudflare proxy endpoint commonly exploited to obscure the true origin of phishing infrastructure. The domain appears on three security blocklists, including MetaMask and PhishDestroy, and is flagged by 4 out of 95 security vendors on VirusTotal. Additional threat intelligence sources, such as AlienVault OTX, include this domain in at least one active threat pulse, while Gridinsoft assigns it a trust score of 0/100, indicating a complete lack of legitimacy. As of the latest assessment, hypexsol.live has been taken offline, likely in response to detection and blocking by security platforms. However, the infrastructure remains a residual risk due to the potential for rapid redeployment under a new domain or IP address. Users who interacted with the site are advised to revoke any connected wallet permissions, monitor for unauthorized transactions, and verify the authenticity of any Hyperliquid-related communications through official channels. Organizations should update blocklists to include this domain and its associated indicators to prevent future exposure.