PhishDestroy has identified the domain app.hyperliquid.global as a potential brand impersonation threat targeting the cryptocurrency platform Hyperliquid. This domain hosts a fake login page designed to deceive users into submitting their credentials, which could be harvested for unauthorized access or malicious crypto draining activities. The main risk involves credential compromise that could lead to financial loss or account takeover.
Technical analysis reveals that app.hyperliquid.global resolves to the IP address 72.61.147.116 and uses an SSL certificate issued by ZeroSSL to create a seemingly legitimate connection. The page title is "Login | Hyperliquid," further contributing to the spoofing attempt. VirusTotal's current scan shows 0 detections out of 95 antivirus engines, indicating the domain has not yet been flagged as malicious by common security vendors. However, the domain is active and under investigation by threat analysts. There is no public data on the registrar or domain creation date provided, and no blocklist counts have been reported so far.
Users who have visited app.hyperliquid.global are strongly advised not to enter any login information or personal data. If credentials were submitted, immediate password changes on the official Hyperliquid platform and enabling two-factor authentication are recommended. Regular monitoring of account activity and reporting suspicious behavior to official support channels can help mitigate risks. Always verify URLs carefully and consult PhishDestroy or other threat intelligence sources for updated information before interacting with any site that mimics known brands like Hyperliquid.
DOM Analysisanalyzed 2026年7月29日score 56/1001 brand signal
Submitted URLhttp://app.hyperliquid.global/
ケース ID
ICANN OVERSIGHTRegistration: hyperliquid.global
認定と RAA の背景
Registrar accreditation and DNS abuse obligations
For the registrable domain hyperliquid.global behind this subdomain, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Primary outcomeDNS 非アクティブreason: DNS NXDOMAIN80% confidence
Attributionsource: Dns Cache
Evidence layersAvailability: DNS inactiveContent: UnreachableDNS: NXDOMAINRegistration: Unknown
Latest HTTP observation不明Probe Inconclusive20%2026-10-19 01:08:01 UTC
RDAP registration不明
Observed timelinelast reachable: 2026-04-10 07:08:55 UTCcurrent episode first observed: 2026-09-30 16:14:55 UTCobserved RIP window: 2026-04-10 07:08:55 UTC → 2026-09-30 16:14:55 UTC · 4,161.10hmidpoint estimate ≈ 2026-07-05 23:41:55 UTC · precision very low · basis bounded
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
使用技術 · 5 identified
P
particles.js
B
Bootstrap
UI frameworks
Popular CSS framework for responsive, mobile-first web development.
L
LiteSpeed
Web servers
High-performance web server compatible with Apache configurations.
J
jsDelivr
CDN
Free public CDN for open-source projects, serving files from npm and GitHub.
H
HTTP/3
Miscellaneous
Third major version of HTTP protocol, built on QUIC for faster, more reliable connections.
Google PageSpeed Insights — mobile performance audit of app.hyperliquid.global· checked Mar 25, 2026
68
Needs Work
Performance
FCP
4.27s
First Contentful Paint
LCP
5.49s
Largest Contentful Paint
CLS
0
Cumulative Layout Shift
TBT
24ms
Total Blocking Time
SI
5.17s
Speed Index
Powered by Google PageSpeed Insights · Mobile strategy · Scores: 90-100 Good50-89 Needs Work0-49 Poor
Registration & observation details8
Availability observations
Last reachable observation
Outcome first observed
Observation window starts
Observation window ends
Estimated change time
Observation window · hours
4161.1
Estimate basis
Bounded by observations
Estimate precision
very_low
An estimated time describes an observation window. It does not prove a registrar action or the exact moment a site became unavailable.
Check for cloaking
Compare what a browser and a crawler receive, and check for Keitaro traffic routing.
No cloaking flag in this check
unavailable: raw=connection_error; http=0; via=http_proxy; error=SOCKSHTTPConnectionPool(host='app.hyperliquid.global', port=80): Max retries exceeded with url: / (Caused by NewConnecti
app.hyperliquid.global
保存済みの結果
到達不能
Stored observation history10
Dated changes retained by the monitor and source collectors. Newest observations appear first; source states are not proof of a takedown.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
