hyperliquds[.]it[.]com

This domain, hyperliquds.it.com, is identified as a brand impersonation threat targeting Hyperliquid, a cryptocurrency exchange and wallet provider. Analysis indicates the site presented itself as 'DigitalVault - Advanced Cryptocurrency Wallet Platform,' a fabricated interface designed to mimic legitimate Hyperliquid services. The objective appears to be the deployment of a cryptocurrency drainer, tricking users into connecting wallets or entering credentials to facilitate unauthorized fund transfers. No specific drainer kit fingerprint was recovered from available metadata, but the page title and impersonation tactics align with known wallet-draining campaigns observed in the wild. Infrastructure analysis reveals the domain was registered through UK-based registrar Intis Telecom Ltd and resolves to the IP address 104.26.4.37. The domain's creation date is listed as October 23, 1992, though this is likely a falsified or misconfigured record, as such an early registration predates modern cryptocurrency infrastructure. Detection metrics show minimal coverage: only 1 out of 95 security vendors on VirusTotal flagged the domain, and it appears on a single security blocklist. Gridinsoft assigned a trust score of 0/100, further indicating malicious intent. No detections were recorded in Google Safe Browsing at the time of analysis. The domain is currently offline, suggesting takedown or voluntary deactivation by the threat actor. However, the risk level remains elevated due to the potential for re-registration, IP rotation, or migration to a new domain under the same registrar. Users who interacted with hyperliquds.it.com should assume credential or wallet compromise and take immediate action: revoke connected wallet permissions, rotate passwords, and monitor for unauthorized transactions. Organizations should update internal blocklists to include this domain and its associated IP, and monitor for related infrastructure using the unique seed identifier 64cc33.