hyperliquidpc[.]xyz

PhishDestroy identifies hyperliquidpc.xyz as an active brand-impersonation domain operating as a crypto drainer targeting the Hyperliquid ecosystem. The domain mimics Hyperliquid’s branding to deceive users into connecting malicious smart contracts that drain wallet funds. No drainer kit artifacts are publicly documented yet, but the site exhibits standard drainer behaviors such as prompting wallet connections and displaying fake liquidity or trade interfaces. Investigators assess the page likely loads a JavaScript wallet-drainer library from a remote host once the user initiates a connection.

Registration details indicate hyperliquidpc.xyz was created on April 14, 2026, resolving to IP 216.198.79.1 via a Let’s Encrypt SSL certificate. VirusTotal shows 0 detections out of 95 scanners, suggesting weak detection coverage. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and remains unlisted on Google Safe Browsing to date. Independent threat intelligence sources have not yet added the domain to blocklists, placing it in a high-risk exposure window.

This campaign is classified as active under investigation with medium-high risk pending further payload analysis. PhishDestroy has flagged the domain with unique seed ffb7fd and recommends immediate network and endpoint blocking. Users should avoid all wallet connections to hyperliquidpc.xyz and verify any Hyperliquid-related links via official channels before interacting. Remaining risk remains elevated while the drainer payload and distribution vectors are still being analyzed.