hyperliquid-events[.]app

PhishDestroy has identified hyperliquid-events.app as a generic phishing domain designed to impersonate HyperLiquid, a decentralized exchange platform. This malicious site was created to deceive users into believing they were accessing official HyperLiquid event pages, potentially leading to credential theft or wallet compromise. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted on IP address 172.67.155.135.

Technical analysis reveals that hyperliquid-events.app has been flagged by 4 out of 95 security vendors on VirusTotal, indicating moderate detection across the security community. The domain was created on April 27, 2026, and appears on three security blocklists. AlienVault OTX has recorded this domain in one threat intelligence pulse, and the SSL certificate was issued by Let's Encrypt (E8). The page title was observed as 'Just a moment...', a common placeholder used by phishing kits. Google Safe Browsing status is not explicitly mentioned but given the blocklist presence, it is likely flagged.

The domain has been taken offline, reducing immediate risk to users. However, PhishDestroy advises continued vigilance as similar domains may emerge. Users who may have interacted with hyperliquid-events.app should change their HyperLiquid passwords and enable two-factor authentication immediately. Avoid clicking on unsolicited links and always verify URLs by checking official channels. PhishDestroy remains committed to tracking and reporting such threats to protect the community.