hyperliquid[.]lol

PhishDestroy identifies hyperliquid.lol as an active crypto drainer domain impersonating the Hyperliquid brand, designed to deceive users into connecting cryptocurrency wallets under false pretenses. This domain was flagged by ScamSniffer and Enkrypt and resolves to an IP address associated with known malicious infrastructure. The threat actor registered the domain through Key-Systems GmbH on June 08, 2025, and it has already appeared on two security blocklists. VirusTotal analysis confirms detection by only 2 out of 95 security vendors, highlighting the stealthy nature of this operation despite its active misuse. The domain leverages a Let's Encrypt SSL certificate to appear legitimate and mimics the official Hyperliquid platform to trick users into authorizing malicious wallet interactions. Attackers likely distribute this domain via phishing emails, fake social media ads, or malicious search ads targeting cryptocurrency traders. Once a user connects their wallet, the drainer automatically siphons assets without requiring additional authentication, exploiting the trust associated with the Hyperliquid brand. Technical indicators include the recent domain creation date and limited early-stage detection, making it critical for users to verify domains thoroughly before any interaction. If you have visited hyperliquid.lol, disconnect your wallet immediately and revoke any unauthorized permissions through your wallet app or browser extension. Do not approve any transaction requests or sign messages from this domain. Report the domain to your browser’s safe browsing tool and share this alert with others. For ongoing protection, use reputable browser extensions like ScamSniffer or Enkrypt that block known crypto drainers. Always verify domain spellings and use official bookmarks for financial platforms.