# PhishDestroy threat dossier — hyperliquidguide.com ================================================================ Fetched: 2026-05-03 21:32:40 UTC Canonical: https://phishdestroy.io/domain/hyperliquidguide.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 97/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Hyperliquid ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 2/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, Kaspersky ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.96.3 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: CloudFlare, Inc. Registrar: Cloudflare, Inc. Nameservers: ["marge.ns.cloudflare.com", "oswald.ns.cloudflare.com"] Registered: 2026-04-30 Page title: Hyperliquid Guide - How to Trade, Bridge, and Earn on Hyperliquid (2026) HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-06-12 Status: INVALID chain Fingerprint: d8b446b00e9c5e8d98a68190798be81f32ed94b7000e79e98a651032fad60654 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-30 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-30 17:43:06 UTC (by PhishDestroy tracker) Last verified: 2026-05-03 21:03:53 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019dded5-e843-73bf-a87e-e5e631424701/ Wayback Machine: https://web.archive.org/web/*/hyperliquidguide.com crt.sh CT logs: https://crt.sh/?q=%25.hyperliquidguide.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=hyperliquidguide.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/hyperliquidguide.com URLhaus: https://urlhaus.abuse.ch/host/hyperliquidguide.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-30 17:44:44 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy flags hyperliquidguide.com as an active brand impersonation domain targeting Hyperliquid, a decentralized perpetual exchange platform. The site mimics Hyperliquid’s branding to deceive users into entering credentials or transferring funds under false pretenses. Given Hyperliquid’s prominence in DeFi, threat actors leverage typosquatting and brand exploitation to harvest sensitive data or facilitate financial theft. This domain represents a direct risk to user trust and platform integrity. This domain was flagged by PhishDestroy’s domain safety pipeline due to strong indicators of brand impersonation. VirusTotal currently reports 0/95 VirusTotal detections, indicating that mainstream antivirus engines have not yet flagged the domain. It was registered via Cloudflare, Inc. on February 27, 2026, and resolves to IP address 188.114.96.3. The domain uses a Google Trust Services SSL certificate, which may lend superficial legitimacy but does not validate the site’s authenticity. The recent creation date (0 days old at time of analysis) combined with brand-targeting behavior signals a high-risk, newly deployed threat actor asset. There are no current blocklist entries in PhishDestroy’s threat intelligence feed, emphasizing the need for proactive domain monitoring. Mitigation requires immediate action from users and platform defenders. Hyperliquid users should verify all links via official channels (hyperliquid.io) and never input credentials on third-party domains, even if they appear legitimate. Security teams should immediately block 188.114.96.3 at the network perimeter and add hyperliquidguide.com to DNS blocklists and browser protection lists. The domain should be reported to Cloudflare’s abuse team and Google Safe Browsing for takedown. Given the absence of AV detections, reliance on threat intelligence platforms like PhishDestroy is critical for early detection. Always cross-reference URLs with the official brand domain to prevent brand impersonation attacks. [Updates since narrative was generated:] - VirusTotal detections: now 2/91 (narrative was written when count was lower) ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: a49d68dbc34142e80152eac19075c0f3 TLS cert SHA-256: d8b446b00e9c5e8d98a68190798be81f32ed94b7000e79e98a651032fad60654 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/hyperliquidguide.com/ JSON API: https://api.destroy.tools/v1/check?domain=hyperliquidguide.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 145,321 domains (56,210 alive under monitoring, 88,856 confirmed takedowns/dead). Site: https://phishdestroy.io