hyperliquidated[.]io

hyperliquidated.io has been singled out for brand impersonation targeting Hyperliquid, a prominent decentralized exchange platform. PhishDestroy analysts identified this domain as part of an active campaign mimicking Hyperliquid’s branding, likely to deceive users into connecting wallet credentials or signing malicious transactions. The domain exhibits hallmarks of a crypto drainer kit designed to siphon funds from unsuspecting victims. Whois data reveals a recent registration, and the lack of historical reputation suggests an opportunistic campaign leveraging Hyperliquid’s growing user base. The domain resolves to IP address 185.253.212.22 and was registered through Key-Systems GmbH on October 11, 2025, indicating a freshly minted infrastructure. VirusTotal currently shows 0 detections out of 95 engines, meaning no AV signatures have been updated to flag this domain yet. Google Safe Browsing (GSB) status remains unlisted, and no major blocklists have flagged it—suggesting it is actively flying under the radar. The domain’s SSL certificate, issued by Let’s Encrypt, adds a veneer of legitimacy often exploited in impersonation campaigns. This domain remains active and under investigation as of this advisory. PhishDestroy recommends immediate blocking at network and endpoint levels due to its high-risk potential. Users should refrain from interacting with hyperliquidated.io and verify Hyperliquid’s official domains via trusted sources. While current detections are low, the absence of prior reputation and alignment with impersonation tactics elevate the risk profile. Monitor closely as this campaign may evolve or expand to other vectors. The remaining risk is classified as active but mitigable through proactive blocking and user awareness.