trade-hyperliquid[.]xyz

This domain, trade-hyperliquid.xyz, is flagged as a brand impersonation threat targeting Hyperliquid, a cryptocurrency trading platform. Analysis indicates the site was designed to deceive users into believing it was an official Hyperliquid portal, likely for credential harvesting or fraudulent fund transfers. No specific drainer kit signatures were identified in available telemetry, but the page title 'Un instant…' suggests a loading or redirection mechanism commonly used in phishing frameworks to delay user detection. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NameSilo, LLC, and resolved to the IP address 104.21.81.15. Security vendor detections on VirusTotal reached 5 out of 95, indicating moderate consensus on its malicious nature. The domain appears on one security blocklist, and Google Safe Browsing (GSB) data was not explicitly referenced in available intelligence. The Gridinsoft trust score of 0/100 further corroborates its classification as a high-risk domain. As of the latest assessment, trade-hyperliquid.xyz has been taken offline, reducing immediate exposure to end users. However, residual risk remains due to potential reuse of the infrastructure or registration of similar domains. Organizations and individuals are advised to monitor for related domains using the same registrar or IP range, implement DNS-based blocking for the resolved IP, and educate users on verifying official Hyperliquid URLs. Security teams should treat any prior interactions with this domain as compromised and initiate credential rotation for affected accounts.