hyperliqu1d[.]co[.]com

PhishDestroy identifies hyperliqu1d.co.com as a brand impersonation domain targeting Hyperliquid, a decentralized exchange platform. This domain is currently offline, but its configuration and underlying infrastructure indicate a clear intent to deceive users into divulging sensitive information. The domain was created on February 21, 2026, and resolves to IP address 104.21.112.1, which is associated with Cloudflare. Despite being taken offline, the domain poses an elevated risk due to its association with a well-known brand and the potential for similar domains to emerge.

VirusTotal data shows that 1 out of 95 security vendors flagged this domain, and it appears on 1 security blocklist. The SSL certificate is classified as WE1, which suggests a low level of trust. The page title was "NexusTrail - Explainable Machine Learning Solutions for Banking," a seemingly legitimate title unrelated to Hyperliquid, likely used to evade initial detection. The domain's registration date is recent, and the fact that it impersonates a high-profile brand like Hyperliquid elevates its risk profile. PhishDestroy's analysis confirms that the domain's structure and behavior are consistent with phishing campaigns, despite being offline.

Given that the domain is currently offline, users should not attempt to visit it. However, PhishDestroy recommends that users remain vigilant for similar domains and avoid clicking on unsolicited links claiming to be from Hyperliquid. If you have already interacted with this domain, change your passwords immediately and enable two-factor authentication on your Hyperliquid account. Always verify the official domain of Hyperliquid before entering any credentials or financial information. The rapid detection and takedown of this domain demonstrate the effectiveness of proactive threat monitoring, but users should stay informed about emerging threats.