hyperliqud[.]app

This domain, hyperliqud.app, poses a targeted brand impersonation threat against Hyperliquid, a decentralized perpetuals exchange. Analysis indicates the site masquerades as a legitimate liquidity intelligence platform, using the page title 'DeepFlow — Liquidity Intelligence' to deceive users into disclosing sensitive credentials or financial information. The campaign appears designed to exploit trust in the Hyperliquid brand, likely targeting users involved in cryptocurrency trading or decentralized finance operations. Evidence supporting the malicious classification includes detection by 13 out of 95 security vendors on VirusTotal, as well as presence on two independent security blocklists. The domain was registered through Tucows Domains Inc. and resolves to the IPv6 address 2606:4700:3035::ac43:d464, indicative of Cloudflare hosting infrastructure. The SSL certificate is issued by Google Trust Services, a common tactic to lend an appearance of legitimacy. Technologies detected include HTTP/3, which may be leveraged to evade traditional network-based detection mechanisms. The domain has since been taken offline, though prior activity suggests a coordinated effort to harvest user data. Users who interacted with hyperliqud.app are advised to take immediate remedial action. Any credentials entered on the site should be considered compromised and revoked across all platforms where they were reused. Affected individuals should monitor financial accounts and cryptocurrency wallets for unauthorized transactions. System scans using updated security tools are recommended to detect potential secondary infections. Given the elevated risk level, organizations should review logs for connections to the domain or associated IP address and assess whether additional internal compromise occurred. Proactive password resets and multi-factor authentication enforcement are strongly advised for all critical accounts.