hyperliquiddev[.]xyz

PhishDestroy identifies hyperliquiddev.xyz as an active brand impersonation domain targeting Hyperliquid, a decentralized exchange platform. This site was registered on July 06, 2025, via Key-Systems GmbH and currently resolves to IP address 185.253.212.22. The domain uses a Let’s Encrypt SSL certificate and remains unflagged on VirusTotal as of the latest scan, with 0 detections out of 95 engines tested. Despite the absence of blacklist entries, the site’s recent registration date and deliberate mimicry of Hyperliquid’s branding represent a clearly elevated risk for users seeking legitimate financial services.

Technical analysis confirms the domain is engineered for deception. The site’s structure, domain name, and SSL certificate are designed to mimic Hyperliquid’s official domains, such as hyperliquid.xyz. Additionally, the use of a newly registered domain (July 2025) and a hosting IP associated with prior malicious campaigns highlights an attempt to exploit brand recognition before detection mechanisms can respond. The attacker’s goal is credential harvesting and unauthorized fund access under the guise of Hyperliquid services.

Users must treat hyperliquiddev.xyz as a confirmed threat. Avoid accessing this domain or interacting with any content hosted on it. Hyperliquid users should manually verify all URLs before entering credentials or downloading files, and utilize official communication channels for updates. Domain administrators are advised to monitor for similar registrations (e.g., hyperliquid[any]dev.[any]) and report this domain to registrars and security platforms like VirusTotal, URLVoid, and abuse contacts at Key-Systems GmbH to expedite blocklisting. This domain should be added to network blocklists and browser-based threat feeds to prevent accidental exposure.