fogo-hyperliquid[.]com

PhishDestroy has identified the domain fogo-hyperliquid.com as a brand impersonation phishing site specifically targeting Hyperliquid. This domain was set up to deceive users into believing they are accessing a legitimate Hyperliquid trading platform, with the page title 'Get Started on Fogo: Trade Without Compromise.' No specific drainer kit was identified during analysis, but the site's design and intent clearly mimic Hyperliquid to harvest credentials or funds.

Technical indicators provide a detailed picture of this threat. The domain has a VirusTotal detection ratio of 3 out of 95 security vendors, indicating some awareness but not widespread flagging. It was registered through NiceNIC International Group Co., Limited, a registrar known for minimal oversight, and resolves to IP address 104.21.45.164. The domain was created on February 21, 2026, making it very recent at the time of analysis. It appears on 4 security blocklists, and its SSL certificate was issued by Google Trust Services (WE1), which is common for Cloudflare-hosted sites.

As of the latest check, fogo-hyperliquid.com has been taken offline, reducing immediate risk. However, the domain remains on blocklists, and users who previously visited the site may still be at risk if they shared sensitive information. PhishDestroy recommends that anyone who interacted with this domain should change their Hyperliquid credentials immediately and enable two-factor authentication. The remaining risk is low now that the site is offline, but similar domains may appear, so users should always verify URLs before entering credentials.