hyperliquid[.]com-swap-v4-dex-secure[.]app

The domain hyperliquid.com-swap-v4-dex-secure.app is a confirmed phishing site engaged in brand impersonation targeting Hyperliquid, a cryptocurrency platform. It poses as a legitimate decentralized exchange (DEX) portal under the guise of 'swap-v4' functionality to deceive users into interacting with fraudulent smart contracts or disclosing sensitive wallet credentials. No active drainer kit was identified, but the site operates as a cryptocurrency scam. As of analysis, hyperliquid.com-swap-v4-dex-secure.app has been taken offline.

Technical indicators reveal limited but notable detection. The domain was flagged by 1 of 95 security vendors on VirusTotal, including Fortinet, and appears on 1 security blocklist (PhishDestroy). It resolves to the IPv6 address 2606:4700:3035::6815:1758, hosted on Cloudflare infrastructure (AS13335) in the US. No SSL certificate was observed, and the page title displayed as 'hyperliquid.com-swap-v4-dex-secure.app'. Registrar details, creation date, and nameservers are not available. Gridinsoft assigned a trust score of 0/100, reinforcing its malicious classification.

Users who interacted with hyperliquid.com-swap-v4-dex-secure.app should immediately revoke any token approvals granted to unknown contracts using tools like Etherscan or Revoke.cash. Transfer remaining funds to a new, secure wallet and monitor transaction history for unauthorized activity. Change passwords for any accounts linked to the impersonated platform and enable two-factor authentication (2FA). Report the phishing domain to Google Safe Browsing, PhishTank, and the impersonated brand’s official security team to aid in takedown efforts.