hyperliquids[.]in2026[.]top

This domain, hyperliquids.in2026.top, is identified as a brand impersonation threat targeting Hyperliquid, a cryptocurrency exchange platform. Analysis indicates the domain was designed to mimic the legitimate Hyperliquid brand, likely to deceive users into divulging sensitive credentials or transferring assets. No specific drainer kit signatures have been confirmed, but the domain’s structure and naming convention align with known phishing tactics used in cryptocurrency-related fraud campaigns.

Infrastructure analysis reveals the following technical indicators: the domain is flagged by 4 out of 95 security vendors on VirusTotal, indicating moderate detection but persistent risk. It was registered on March 28, 2026, through Web Commerce Communications Ltd, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 103.221.221.78, which has been linked to other malicious activities. It currently appears on one security blocklist and holds a Gridinsoft trust score of 0/100, reflecting its fraudulent nature. Google Safe Browsing (GSB) status is not explicitly provided, but the domain’s offline status suggests it may have been temporarily suspended or abandoned.

As of the latest assessment, hyperliquids.in2026.top has been taken offline, likely due to enforcement actions by security providers or hosting services. While the domain is no longer active, the infrastructure remains a potential risk, as threat actors may re-deploy similar domains or reuse the IP address for future campaigns. Users and organizations are advised to monitor for related domains, implement DNS-based blocking for the resolved IP, and educate stakeholders on recognizing brand impersonation tactics. Proactive measures, such as real-time threat intelligence feeds and endpoint protection, are recommended to mitigate residual risks associated with this threat.