hyp3rliquid[.]xyz

This domain is flagged for elevated-risk brand impersonation targeting Hyperliquid, a decentralized perpetual futures exchange. The threat involves presenting a fraudulent trading interface displaying fabricated market data (21.766 | HYPE/USDC) to deceive users into connecting cryptocurrency wallets or submitting login credentials, enabling unauthorized asset transfers or account takeovers. Infrastructure analysis reveals the domain hyp3rliquid.xyz was registered on February 21, 2026, through Key-Systems LLC, resolving to IP address 185.253.212.22 (AS48707, OPS PL sp. z o.o., Germany). The domain appears on one security blocklist and is flagged by 10 of 95 security vendors on VirusTotal. It uses a Let's Encrypt SSL certificate (R12) to present a false sense of legitimacy. The single blocklist detection (PhishDestroy) and low vendor flagging rate suggest either recent deployment or evasion techniques targeting specific user groups. Mitigation requires immediate domain blacklisting at network and endpoint levels, particularly for entities interacting with cryptocurrency platforms. Users should verify official Hyperliquid communication channels for legitimate URLs and enable multi-factor authentication where available. Wallet connections should only be authorized on verified interfaces, and transaction signing should be scrutinized for unexpected asset movements. Organizations should monitor for similar impersonation patterns involving trading pair displays (e.g., HYPE/USDC) and domain name obfuscation using numeric substitutions (hyp3rliquid).