hyperliquid-distribution[.]xyz

This domain, hyperliquid-distribution.xyz, is flagged as an active brand impersonation threat targeting Hyperliquid, a decentralized perpetuals exchange. Analysis indicates the site operates as a crypto wallet drainer, designed to trick users into connecting wallets to malicious smart contracts that execute unauthorized token transfers. The infrastructure mimics legitimate Hyperliquid distribution pages, leveraging social engineering tactics such as fake airdrop claims to facilitate credential and asset theft. Infrastructure analysis reveals the domain was registered on June 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to IP address 172.67.176.118, a Cloudflare proxy endpoint commonly used to obfuscate hosting origins. Detection metrics show 4 out of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on 2 security blocklists. The SSL certificate is issued by Google Trust Services, providing a veneer of legitimacy despite the domain's fraudulent intent. As of the latest assessment, hyperliquid-distribution.xyz remains active and is blocked by MetaMask and SEAL, indicating ongoing malicious activity. Users are advised to treat any interaction with this domain as a critical security risk. Organizations should update blocklists to include the domain and its associated IP, while individuals should verify all distribution claims directly through Hyperliquid's official channels. The persistent nature of this threat underscores the need for continuous monitoring of newly registered domains impersonating cryptocurrency platforms.