hyperliquid[.]vip

The domain hyperliquid.vip has been identified as a brand impersonation threat specifically targeting Hyperliquid, a decentralized trading platform. This domain was operationalized to deceive users into divulging sensitive credentials or interacting with fraudulent interfaces under the guise of legitimate Hyperliquid services. Current analysis confirms the domain is offline, though prior activity warrants continued scrutiny. Infrastructure analysis reveals the domain was registered on March 28, 2026, through Key-Systems LLC, a registrar commonly associated with both legitimate and malicious registrations. It resolved to the IP address 185.253.212.22, a host that may share infrastructure with other suspicious domains. The domain’s SSL certificate was issued by Let’s Encrypt, a common choice for both benign and malicious actors due to its accessibility. Detection metrics indicate the domain was flagged by 5 of 95 security vendors on VirusTotal, while appearing on one security blocklist and one threat intelligence pulse in AlienVault OTX. Gridinsoft assigned a trust score of 0 out of 100, further corroborating its malicious classification. At present, hyperliquid.vip is offline, though its prior registration and detection history suggest it may re-emerge under altered infrastructure. Organizations and users are advised to monitor for renewed activity associated with this domain or its registrant details. Network defenders should block the IP address 185.253.212.22 and implement detection rules for domains impersonating Hyperliquid. End-users should verify the authenticity of any communication or interface claiming affiliation with Hyperliquid, particularly those soliciting credentials or financial transactions. Proactive threat hunting for related indicators of compromise is recommended to mitigate potential follow-on attacks.