hyperliquld[.]store

This domain, hyperliquld.store, is identified as a confirmed phishing site specializing in brand impersonation targeting Hyperliquid, a cryptocurrency exchange platform. Analysis confirms the domain was actively used to deceive users into submitting sensitive credentials through a fraudulent interface mimicking the legitimate Hyperliquid service. The site is currently offline, but prior activity warrants continued monitoring and mitigation measures. Infrastructure analysis reveals the domain was registered through Squarespace Domains LLC and created on March 28, 2026, an anomalous future date suggesting possible registration irregularities or data manipulation. It resolved to the IP address 172.67.170.197 and utilized a Let's Encrypt SSL certificate, which, while providing encryption, does not validate legitimacy. The domain was flagged by 16 of 95 security vendors on VirusTotal, appears on one security blocklist, and was included in one AlienVault OTX threat intelligence pulse. Gridinsoft assigned a trust score of 0/100, further confirming its malicious classification. Current status indicates the domain has been taken offline, reducing immediate risk to end users. However, the infrastructure may remain under adversary control, posing potential for reactivation or repurposing. Organizations and individuals are advised to block the domain and associated IP at the network level, revoke any credentials potentially exposed through interaction with the site, and monitor for related phishing campaigns. Users should verify domain authenticity before entering sensitive information and report any suspicious activity to relevant security teams for further analysis.