app[.]hyp[.]erliquid[.]xyz

PhishDestroy has identified app.hyp.erliquid.xyz as a confirmed phishing domain currently under investigation, with a risk level indicating it impersonates the Hyperliquid brand. This is a brand impersonation scam designed to trick users into connecting their wallets or entering credentials, leading to asset theft via a crypto drainer. The domain was taken offline after detection, but users should remain vigilant as similar domains may appear.

The domain was registered on February 21, 2026, and resolves to IP address 104.21.64.1, which is associated with Cloudflare. SSL certificate WE1 was issued, but the site has been taken offline. VirusTotal shows 0 out of 95 security vendors flagging the domain, meaning it has not yet been widely detected. However, it appears on one security blocklist, and the unique seed a5b0d1 confirms this specific instance. The domain name itself is a typosquat of Hyperliquid, using hyphens and a different TLD to deceive users.

Users should never interact with this domain or any similar-looking URLs. To stay safe, always verify the official Hyperliquid website by bookmarking it or using a trusted source. If you have already connected your wallet or entered any information, immediately revoke permissions and transfer assets to a new wallet. Report any suspicious domains to PhishDestroy and warn others. Use a hardware wallet and enable two-factor authentication where possible. Remember, legitimate platforms will never ask for your private keys or seed phrases.