hypersliquid[.]claims

This domain, hypersliquid.claims, is identified as a confirmed brand impersonation site designed to deceive users of Hyperliquid, a decentralized exchange platform. The site likely operates as a crypto drainer or fake login portal, tricking visitors into entering sensitive credentials or connecting wallets, which could lead to unauthorized fund transfers or account takeovers. The infrastructure is tailored to mimic legitimate Hyperliquid interfaces, increasing the likelihood of successful social engineering attacks against unsuspecting users. Analysis of the domain reveals multiple high-confidence indicators of malicious activity. The domain is flagged by 4 out of 95 security vendors on VirusTotal, indicating a consensus among threat detection engines. It was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. Additionally, hypersliquid.claims appears on three security blocklists and resolves to the IP address 104.21.65.233, which has been linked to other fraudulent activities. The page title 'Just a moment...' further suggests the use of evasion techniques to delay or obscure detection. Users who visited hypersliquid.claims should take immediate action to mitigate potential risks. If any credentials or wallet connections were entered, affected parties should revoke all active sessions and permissions from their Hyperliquid accounts and associated wallets. It is recommended to scan local devices for malware using updated security tools, as the domain may have delivered additional payloads. Monitor financial transactions for unauthorized activity and consider reporting the incident to relevant blockchain security teams for further investigation. Given the domain's current offline status, users should remain vigilant for similar impersonation attempts targeting Hyperliquid or other crypto platforms.