hyper-liquid[.]money

The domain hyper-liquid.money is an active phishing site engaged in brand impersonation targeting Hyperliquid, a cryptocurrency platform. It presents itself as a legitimate Hyperliquid service but is designed to deceive users into disclosing sensitive information or transferring cryptocurrency under false pretenses. As of the latest verification, hyper-liquid.money remains operational and poses an elevated risk to unsuspecting visitors, particularly those familiar with the Hyperliquid brand.

Technical analysis reveals that hyper-liquid.money is flagged by 2 of 95 security vendors on VirusTotal, including Fortinet and SOCRadar. The domain is registered through NiceNIC International Group Co., Limited and was created on March 10, 2026. It resolves to the IP address 188.114.97.3, hosted on Cloudflare's infrastructure (AS13335). The site appears on 3 security blocklists, including PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Let's Encrypt (E8), and the observed page title is 'Just a moment...'. Technologies detected include HSTS, Cloudflare Browser Insights, and HTTP/3.

Users who may have interacted with hyper-liquid.money should immediately revoke any token approvals granted to unknown or suspicious contracts and transfer remaining funds to a new, secure wallet. If credentials were entered, change passwords on the legitimate Hyperliquid platform and enable two-factor authentication. Monitor accounts for unauthorized transactions and report the phishing domain to relevant authorities, such as the impersonated brand's security team, anti-phishing organizations like PhishTank, and the domain registrar (NiceNIC International Group Co., Limited).