eth-hyperliquid[.]click

Analysis of eth-hyperliquid.click indicates that the domain was registered on June 08, 2026 through Dynadot, LLC. DNS resolution points to the IPv4 address 130.12.180.128, which is the sole host observed for this indicator. The domain appears on three independent security blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL, confirming that multiple protective services have identified it as malicious. VirusTotal has processed the domain and five of ninety‑one scanners returned a malicious verdict, reinforcing the suspicion despite the majority of vendors not flagging it.

The threat is catalogued as generic phishing and the current risk rating is elevated; the operational status remains active as of the report date, July 29, 2026. No additional public artifacts such as SSL certificates, HTTP response codes, or page titles have been disclosed, so the exact content served by the site cannot be verified at this time. Defenders should continue to block the domain at network perimeter and DNS layers, add the associated IP address 130.12.180.128 to host‑based deny lists, and monitor for any outbound connections to that address.

Because the domain is newly created and already listed on multiple blocklists, telemetry should be collected for any attempted connections from internal hosts, and incident response playbooks for phishing should be invoked if user credentials are submitted. Ongoing observation of the domain’s presence on additional blocklists and future VirusTotal scans is recommended to track changes in detection coverage.