# PhishDestroy domain threat record: m-hyperliquid.web.app Content language: English Canonical HTML report: https://phishdestroy.io/domain/m-hyperliquid.web.app/ Machine-readable companion: https://phishdestroy.io/domain/m-hyperliquid.web.app/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-08-31 07:52:57 UTC - Last availability or vendor check: 2026-10-22 10:05:38 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 8/89 - Independent public blocklist matches in the stored snapshot: 1 - Matching public blocklists: ScamSniffer - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Hyperliquid ## Stored infrastructure - Observed IP address: 199.36.158.100 - Registrar in stored WHOIS data: Google LLC - Registrar country in stored WHOIS data: US - Last stored HTTP status: 301 - Registration date (registry RDAP, web.app): 2019-01-08 22:05:04 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a056cd-726d-7705-b8ea-549d5384ec7c/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/m-hyperliquid.web.app - Certificate Transparency search: https://crt.sh/?q=%25.m-hyperliquid.web.app - Web Archive lookup: https://web.archive.org/web/*/https://m-hyperliquid.web.app/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview m-hyperliquid.web.app is an impersonation phishing page that poses as Hyperliquid, the on-chain perpetuals exchange, and shows the title "Hyper Foundation" to look like an official project page. It targets Hyperliquid users who arrive through search results, social posts or direct messages. PhishDestroy first flagged it on 2026-08-31. As of 2026-10-19 the site was still alive and its content was reachable through a redirect. How the scam works The "m-" prefix and the Foundation branding are meant to pass as a mobile or official Hyperliquid portal, often promoted with airdrop, claim or account-verification lures. Pages like this typically ask the visitor to connect a wallet and sign transactions or messages, or to type in a recovery phrase. Either way, the attacker gains control of the victim's tokens and positions. urlscan.io matched elements of the 16shop phishing kit alongside generic crypto branding, which points to a reused phishing template rather than a one-off copy. Evidence urlscan.io rated the page malicious. On 2026-09-14, eight of 89 VirusTotal engines flagged it: alphaMountain.ai, ESET, Emsisoft, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, Netcraft and Webroot. That is a minority of engines, but it includes several established web-threat vendors. ScamSniffer, a wallet-security feed, lists the domain independently of PhishDestroy. Infrastructure The page sits on web.app, a hosting domain registered through Google LLC. Free subdomains there can be created in minutes, so operators can replace a takedown with a new copy quickly. Traffic resolves to a Fastly, Inc. network in the US, and the TLS certificate comes from Google Trust Services. The padlock comes with the hosting platform and says nothing about whether the site is legitimate. What to do If you connected a wallet or signed anything on this page, revoke its token approvals and permissions right away with a reputable approval checker, and move any remaining funds to a fresh wallet. If you entered a recovery phrase, treat that wallet as fully compromised and move your assets to a new seed immediately. Reach Hyperliquid only through bookmarked official addresses, and ignore Foundation claim links sent in DMs. Defenders should block the domain, watch for other Hyperliquid-themed subdomains on free hosting platforms, and report the page to the hosting provider for removal. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a056cd-726d-7705-b8ea-549d5384ec7c/ VirusTotal report: https://www.virustotal.com/gui/domain/m-hyperliquid.web.app Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=m-hyperliquid.web.app Archived copy: https://web.archive.org/web/20260831075554/https://m-hyperliquid.web.app/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:53:44 UTC ## Stored page captures - Primary capture: https://i.ibb.co/PGjKCKnt/5051857d3008.png Captured: 2026-08-31 07:52:57 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a056cd-726d-7705-b8ea-549d5384ec7c.png Captured: 2026-08-31 07:52:57 UTC Source report: https://urlscan.io/result/01a056cd-726d-7705-b8ea-549d5384ec7c/ ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T04:26:40Z", "uuid": "01a056cd-726d-7705-b8ea-549d5384ec7c", "scanned_at": "2026-08-31T07:51:45Z", "final_url": "https://m-hyperliquid.web.app/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://m-hyperliquid.web.app/", "from": "http://m-hyperliquid.web.app/", "status": 307 } ], "ip": "2620:0:890::100", "ips": [ "199.36.158.100", "2620:0:890::100" ], "asns": [ "54113" ], "countries": [ "US" ], "doc_hash": "940760beb2c3d5989e5a0bcad62d04dc1686f34ad98e0ab831b3e27892bdcf43", "script_hashes": [ "f62f29a8e6a07c4cb1ab27104fa5e172e7e7385965c308126b8d698a445b6cf3" ], "globals": [ "ontouchcancel", "ontouchend", "ontouchmove", "ontouchstart", "openTab", "showErrorPopup", "closeModal", "searchInput", "walletItems" ], "tls": { "san": [ "web.app", "*.web.app" ], "cipher": "AES_128_GCM", "issuer": "WR4", "subject": "web.app", "protocol": "TLS 1.3", "valid_to": "2026-10-18T14:59:54Z", "valid_from": "2026-07-20T14:59:55Z" }, "domain_age_days": 1, "apex_age_days": 1, "tls_age_days": 41, "tls_valid_days": 89, "requests": 131, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 100, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "genericcrypto", "16shop" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Generic Crypto", "16Shop" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=31556926; includeSubDomains; preload" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:37:37Z", "uuid": "ad0b6577-174b-40fe-8fdc-f5c36caa4fb1", "scanned_at": "2026-08-31T08:30:55Z", "final_url": "https://m-hyperliquid.web.app/", "status": 200, "redirected": "https-only", "history": [ { "url": "http://m-hyperliquid.web.app/", "status": 307 }, { "url": "https://m-hyperliquid.web.app/", "status": 200 } ], "dom_hash": "391d84bbab261428da59e1e7a4186e2c03549e407817a6d027946e7a82b6d890", "doc_hash": "940760beb2c3d5989e5a0bcad62d04dc1686f34ad98e0ab831b3e27892bdcf43", "phishing_v2": [ "phishing" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "m-hyperliquid.web.app", "type": "A", "value": "199.36.158.100" }, { "name": "m-hyperliquid.web.app", "type": "AAAA", "value": "2620:0:890::100" } ], "dnssec_valid": false, "ip": "199.36.158.100", "whois": { "registrar": "MarkMonitor Inc.", "created": "2019-01-08T22:05:04Z", "updated": "2025-12-12T10:38:29Z", "expires": "2027-01-08T22:05:04Z", "nameservers": [ "ns1.googledomains.com", "ns2.googledomains.com", "ns3.googledomains.com", "ns4.googledomains.com" ] } } } ```