# hyperliquid.ooo — SUSPICIOUS

> Domain hyperliquid.ooo linked to brand impersonation phishing targeting Hyperliquid. Check the full report for IOCs and risk details.

## Summary
PhishDestroy identifies hyperliquid.ooo as an active brand impersonation threat targeting Hyperliquid, specifically designed to deceive users into surrendering credentials or assets under the guise of the legitimate Hyperliquid platform. This domain employs a drainer kit or phishing page mimicking Hyperliquid’s interface, leveraging social engineering to exploit trust in the original brand. The malicious infrastructure is already operational, with no evidence of takedown, posing an immediate risk to users searching for Hyperliquid services or attempting to access trading platforms.  Domain hyperliquid.ooo was registered on June 08, 2025, through Key-Systems GmbH and resolves to IP 185.253.212.22. The domain holds a valid SSL certificate issued by Let’s Encrypt, which may lull users into a false sense of security. Security vendor analysis via VirusTotal reveals a low detection rate of only 2 out of 95, indicating limited but concerning visibility among AV vendors. While the domain has not been flagged by Google Safe Browsing (GSB) at this time, it has been identified on at least one known blocklist, compounding its potential danger to unsuspecting users.  As of today, hyperliquid.ooo remains active and unblocked by major browsers or security platforms, maintaining an elevated risk profile. Immediate defensive actions include blocking the domain at the DNS/network level and flagging the associated IP 185.253.212.22 for further scrutiny. Users are strongly advised to verify Hyperliquid access points via official channels only and avoid clicking links from unsolicited communications. While this domain shows signs of low sophistication in evading detection, the risk of successful user compromise remains significant due to brand familiarity and plausible mimicry. Remaining risk is classified as elevated until active remediation or takedown occurs.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Hyperliquid

## Domain Intelligence
- Registered: 2025-06-08 09:57:04
- Registrar: Key-Systems GmbH
- IP: 185.253.212.22

## Detection Status
- VirusTotal: 2 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/36e80255-ff74-47bd-a4be-acacf3475285
- PhishDestroy: https://phishdestroy.io/domain/hyperliquid.ooo/
- LLM endpoint: https://phishdestroy.io/domain/hyperliquid.ooo/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/hyperliquid.ooo/
Last updated: 2026-03-28