hyperliquidx[.]io

This domain, hyperliquidx.io, is confirmed to operate as a credential harvesting platform specifically targeting users of the Hyperliquid cryptocurrency exchange. Analysis indicates the site employs brand impersonation techniques to deceive victims into submitting wallet credentials, API keys, and two-factor authentication codes under the pretense of account verification or security updates. The infrastructure mimics legitimate Hyperliquid interfaces, including visual design elements and URL structures, to increase the likelihood of successful compromise. Infrastructure analysis reveals hyperliquidx.io was registered on March 28, 2026, through Key-Systems GmbH, with an SSL certificate issued by Let's Encrypt. The domain currently resolves to IP address 185.253.212.22 and appears on one security blocklist. VirusTotal detection metrics show 3 out of 95 security vendors flag the domain as malicious, while AlienVault OTX records its presence in one threat intelligence pulse. Gridinsoft assigns a trust score of 0/100, reinforcing the domain's association with confirmed malicious activity. Users who accessed hyperliquidx.io should immediately revoke any credentials or API keys entered on the site. Cryptocurrency wallets or exchange accounts linked to the domain must be reviewed for unauthorized transactions. System-level scans using updated endpoint protection tools are recommended to detect potential secondary infections. Network administrators should block the domain and associated IP address 185.253.212.22 at the perimeter to prevent further exposure. Any suspicious activity should be reported to relevant financial or cybersecurity authorities for further investigation.