hyperliquid[.]gg

The domain hyperliquid.gg posed as a crypto drainer, impersonating the Binance brand to trick users into connecting their wallets or entering sensitive information. The page title, "Hyperliquid explained - Your Hub to the Hyperliquid Universe - Hyperliquid.gg," was designed to appear legitimate, but the site was built solely to drain cryptocurrency assets from victims. This type of threat often uses fake login interfaces or wallet connection prompts to steal credentials and private keys.

Evidence from multiple sources confirms the malicious nature of this domain. VirusTotal reported that 16 out of 95 security vendors flagged hyperliquid.gg as malicious. The domain was registered through Spaceship, Inc. and resolved to IP address 116.203.227.220. It appeared on 4 security blocklists and was found in 16 threat intelligence pulses on AlienVault OTX. The SSL certificate was issued by Let's Encrypt (R13), which is common among phishing sites. The domain has since been taken offline, but its infrastructure remains a risk.

If any user visited hyperliquid.gg and entered personal information, connected a crypto wallet, or downloaded files, they should immediately take action. Change passwords for any accounts used on the site, revoke wallet permissions via settings or block explorers, and monitor all financial accounts for unauthorized activity. Run a full security scan on any device that accessed the domain. Report the incident to relevant platforms and consider enabling two-factor authentication everywhere. PhishDestroy advises staying vigilant against similar threats and always verifying URLs before interacting with crypto-related sites.