dex-hyperliquid[.]wixstudio[.]com

PhishDestroy identifies dex-hyperliquid.wixstudio.com as an active crypto-drainer domain masquerading as Hyperliquid. The site uses WixStudio hosting to deliver a fraudulent front end that prompts users to connect their crypto wallets, where a drainer script would silently siphon tokens. Brand impersonation is the primary lure, exploiting Hyperliquid’s reputation in the DeFi space to trick victims into authorizing malicious transactions.

Technical indicators confirm the domain’s recent deployment and low detection rate. VirusTotal shows 0 detections out of 95 engines as of the last scan, indicating evasion of most antivirus signatures. The domain resolves to IP 34.144.206.118 on a shared Wix infrastructure block. The SSL certificate is issued by Let’s Encrypt with a valid chain, increasing user trust. WHOIS data reveals a creation timestamp within the last 30 days, consistent with a fast-flux campaign. Google Safe Browsing (GSB) has not yet flagged the URL, and aggregate blocklist counts remain at zero, leaving browsers and security tools unaware.

Current status is active and spreading via social media, phishing emails, and impersonated support channels. Response actions include notifying Wix abuse, submitting the domain to GSB and multiple threat-intel feeds, and publishing IOCs to open blocklists. Despite these efforts, risk remains high due to the zero-detection window and absence from blocklists. Users are advised to block the domain at the network level, verify site certificates manually, and never approve wallet connections on third-party sites. Remaining risk is evaluated as high until signature coverage improves and GSB classification updates.