claims-hyperliquid[.]foundation

The domain claims-hyperliquid.foundation was identified as a brand impersonation phishing threat, specifically targeting the Foundation brand. While no drainer kit was explicitly detected, the domain's design and purpose strongly suggest credential harvesting or other fraudulent activities. The page title 'Un momento…' is typical of phishing landing pages that attempt to mimic legitimate login or verification processes.

Technical indicators provide a clear picture of the threat. VirusTotal flagged the domain with a score of 1 out of 95 security vendors, indicating low detection coverage at the time of analysis. The domain is listed on one security blocklist. It was registered on November 13, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, and resolves to IP address 188.114.97.3. No SSL certificate was present, which is a common red flag for phishing sites. The domain's creation date is very recent, aligning with typical phishing domain lifecycles.

As of the latest check, the domain has been taken offline, reducing immediate risk. However, the low detection rate on VirusTotal suggests that similar domains may evade security filters. Users are advised to remain vigilant against unsolicited communications referencing Foundation-branded services. Always verify URLs directly through official channels and avoid clicking on links in emails or messages. Check the full report for detailed analysis and updates.