hyperliquid-treasury[.]xyz

The domain hyperliquid-treasury.xyz is currently listed as an active generic phishing infrastructure with an elevated risk rating. According to the latest intelligence, the domain has been added to the PhishDestroy blocklist and is present on one additional security blocklist. VirusTotal analysis shows that three out of ninety‑one scanning engines have reported a detection, indicating that at least a minority of AV products recognize malicious behavior associated with the host.

No further public metadata such as registrar details, hosting IP, ASN, or SSL certificate information has been released, so the underlying infrastructure cannot be fully profiled at this time. The limited detection count suggests that the payload or landing page may be evasive or that the site is newly deployed, but the presence on multiple blocklists confirms a consensus that the domain is being used for credential‑stealing or fraudulent activity. Defenders should immediately add hyperliquid-treasury.xyz to network‑level deny lists, configure web proxies to block HTTP/HTTPS requests to the host, and monitor DNS query logs for any resolution attempts.

Because the domain is actively flagged, automated threat‑intelligence feeds that incorporate PhishDestroy and VirusTotal data will already generate alerts; however, manual verification of endpoint logs for authentication attempts to the domain is recommended. Continuous re‑evaluation is advised as additional scanning results or blocklist entries may appear, which could increase the detection ratio and provide further context such as hosting location or associated malware families.