app-hyperllquid[.]co

PhishDestroy has identified app-hyperllquid.co as a brand impersonation domain specifically designed to mimic Hyperliquid, a decentralized exchange platform. The domain is currently offline, but its recent creation and malicious intent pose a significant risk to users who may have encountered it before takedown. This threat type, brand impersonation, is commonly used to steal login credentials or trick users into connecting wallets to drain funds.

Technical analysis reveals that app-hyperllquid.co was created on April 4, 2026, and is flagged by 3 out of 95 VirusTotal vendors as malicious. The domain appears on at least three security blocklists, indicating prior recognition by threat intelligence sources. While the registrar and IP are not specified in the available data, the low trust score and high-risk classification underscore its fraudulent nature. The domain's name, app-hyperllquid.co, is a deliberate misspelling of the legitimate Hyperliquid domain, a classic brand impersonation tactic.

Given that app-hyperllquid.co has been taken offline, users are advised to ensure they have not previously visited the domain or entered any sensitive information. If any credentials or wallet keys were submitted, they should be changed immediately. PhishDestroy recommends monitoring accounts for unusual activity and enabling two-factor authentication where possible. Staying vigilant against typosquatting domains and verifying URLs before interacting is crucial to avoiding similar threats in the future.