hyperliquid-zenith-trade[.]com

The domain www.hyperliquid-zenith-trade.com is flagged for brand impersonation, specifically targeting the well-known cryptocurrency platform Hyperliquid. The website, which uses the page title 'Zenith Wallet,' is designed to deceive users into believing they are interacting with a legitimate Hyperliquid service. There is no evidence of a specific drainer kit being used, but the domain's creation and technical setup suggest a deliberate attempt to mimic the brand's online presence and potentially steal user credentials or funds.

Infrastructure analysis reveals that the domain has a VirusTotal detection score of 0/95, indicating that it has not yet been flagged by the majority of antivirus engines. The domain is registered through IONOS SE, a popular domain registrar, and resolves to the IP address 216.24.57.7. The domain was created on March 31, 2026, and appears on one security blocklist. The Gridinsoft trust score for the domain is 0/100, reflecting a complete lack of trustworthiness. Additionally, the domain uses Cloudflare and HTTP/3 technologies, which can be indicative of efforts to mask the true origin and enhance the site's performance and credibility.

The current status of the domain is offline, suggesting that it has been taken down as part of a response to the detected threat. However, even with the domain offline, the risk remains as the infrastructure and technical setup could be reused or repurposed for future attacks. It is recommended that users who may have interacted with this domain monitor their Hyperliquid accounts for any unauthorized activity and report any suspicious behavior to Hyperliquid's support team. Security teams should continue to monitor the IP address 216.24.57.7 and the registrar IONOS SE for any related activity and consider adding the domain to their blocklists to prevent further exposure.