hypreliquid[.]live

PhishDestroy identifies hypreliquid.live as an active brand impersonation campaign targeting Hyperliquid users. This domain masquerades as the legitimate Hyperliquid platform to trick visitors into connecting their cryptocurrency wallets or entering sensitive credentials, ultimately aiming to drain digital assets. The site's page title explicitly reads "Hyperliquid," demonstrating a deliberate attempt to deceive users seeking the real platform.

Evidence of malicious intent is substantial. VirusTotal flags this domain with 4 out of 95 security vendors marking it as malicious, indicating broad recognition across the security community. The domain was registered on March 22, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar often associated with high-risk domains. It currently appears on three separate security blocklists and is protected by a Let's Encrypt SSL certificate (E8), which provides a false sense of security. The domain resolves to IP address 172.67.162.49.

Users who have visited hypreliquid.live should immediately disconnect their cryptocurrency wallets from any associated sites and revoke any permissions granted. It is also advisable to run a full security scan on their devices and monitor for unauthorized transactions. As a general rule, always verify the official URL of Hyperliquid by bookmarking it directly and never clicking on links from unsolicited messages or search results. If credentials were entered, change passwords immediately and enable two-factor authentication on all accounts.