hyperliquidcapital[.]limited

The domain hyperliquidcapital.limited has been identified as a brand impersonation threat targeting the Celer brand. This phishing domain was designed to deceive users into believing it is associated with the legitimate Celer project, likely to steal cryptocurrency or sensitive credentials. Analysis indicates the presence of a crypto drainer kit, which automatically siphons funds from victims' wallets upon interaction. The domain's page title, 'Bitwarder | Bitwarder Giriş | Your One- Stop Design Solution | Bitwarder,' is a clear attempt to impersonate the popular password manager Bitwarder, further indicating a multi-brand phishing scheme.

Technical indicators reveal that VirusTotal flagged this domain with 13 out of 95 security vendors, confirming its malicious nature. The domain is registered through Cloudflare, Inc., and resolves to IP address 172.67.156.162. It was found in one threat intelligence pulse on AlienVault OTX and appears on one security blocklist. The SSL certificate was issued by Google Trust Services / WE1, providing a false sense of security. Google Safe Browsing (GSB) status is not explicitly mentioned, but the domain's presence on blocklists suggests active detection. The domain is currently offline, but its registration through Cloudflare may allow rapid redeployment.

As of the latest analysis, hyperliquidcapital.limited has been taken offline, mitigating immediate risk. However, users should remain vigilant as similar domains may appear. PhishDestroy recommends verifying any communication claiming to be from Celer or Bitwarder on the official PhishDestroy platform. Users should never connect wallets or enter credentials on suspicious sites. If previously interacted with this domain, immediately revoke wallet permissions and change passwords. The seed '92df34' is used to uniquely identify this threat in the PhishDestroy database.