hyperliquid[.]in2026[.]top

This domain, hyperliquid.in2026.top, is flagged for brand impersonation targeting Hyperliquid, a decentralized perpetuals exchange. Analysis indicates the infrastructure was designed to mimic the legitimate platform’s interface, likely to harvest user credentials or private keys under false pretenses. The page title explicitly matches the brand name, reinforcing the deception. No specific drainer kit signatures were identified, but the domain’s technical configuration aligns with common phishing deployment patterns. Infrastructure analysis reveals the domain was registered on March 28, 2026, through Web Commerce Communications Ltd, a registrar frequently associated with newly spun-up malicious sites. It resolves to the IP address 103.221.221.78, which has been linked to other transient phishing campaigns. VirusTotal detection shows 3 out of 95 security vendors flagging the domain, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is actively blocked by PhishDestroy. Technologies detected include LiteSpeed and HTTP/3, suggesting a modern web server configuration optimized for rapid deployment and evasion. As of the latest verification, hyperliquid.in2026.top has been taken offline, reducing immediate exposure. However, the infrastructure’s recent creation and low detection rates indicate a calculated effort to evade automated defenses. Users who interacted with the domain prior to takedown should assume credential compromise and initiate account recovery protocols, including key rotation and transaction monitoring. Organizations should monitor for similar domains registered under the same registrar or resolving to the identified IP, as threat actors often reuse infrastructure across campaigns.