hyperliquid-sol[.]xyz

PhishDestroy identifies hyperliquid-sol.xyz as a malicious domain masquerading as Hyperliquid, a legitimate cryptocurrency derivatives platform. This domain employs a generic phishing tactic known as a drainer, designed to trick users into connecting their wallets and approving malicious transactions. The threat actor leverages a visually similar domain to exploit the trust users place in Hyperliquid's brand, aiming to siphon crypto assets under the guise of legitimate trading operations.

Technical indicators confirm the hostile nature of hyperliquid-sol.xyz. VirusTotal currently flags this domain with a mere 2 out of 95 security vendors detecting it, indicating low global awareness or evasion tactics. The domain is registered through Global Domain Group LLC and resolves to 172.67.192.204, a Cloudflare IP frequently abused for malicious activities. Registered on June 21, 2026, the domain is less than a month old, a common trait for disposable phishing infrastructure. Nameservers rommy.ns.cloudflare.com and veronica.ns.cloudflare.com further obscure the domain's origins while benefiting from Cloudflare's protective services. As of the latest checks, this domain remains active and unlisted on Google Safe Browsing (GSB).

The current status of hyperliquid-sol.xyz is active, with no signs of takedown actions at this time. Immediate action is recommended for all users: block the domain at the network and endpoint levels, update local blocklists, and warn communities likely to interact with Hyperliquid. The remaining risk is high due to the domain's recent creation, low detection rate, and the irreversible nature of cryptocurrency theft. Organizations should flag this domain in their SIEM, EDR, and proxy solutions while monitoring for any shifts in infrastructure. Threat intelligence sharing is critical to prevent further victimization. Failure to act promptly may result in significant financial losses for unwary users.