app[.]hyperliquid[.]global

PhishDestroy has identified the domain app.hyperliquid.global as a potential brand impersonation threat targeting the cryptocurrency platform Hyperliquid. This domain hosts a fake login page designed to deceive users into submitting their credentials, which could be harvested for unauthorized access or malicious crypto draining activities. The main risk involves credential compromise that could lead to financial loss or account takeover.

Technical analysis reveals that app.hyperliquid.global resolves to the IP address 72.61.147.116 and uses an SSL certificate issued by ZeroSSL to create a seemingly legitimate connection. The page title is "Login | Hyperliquid," further contributing to the spoofing attempt. VirusTotal's current scan shows 0 detections out of 95 antivirus engines, indicating the domain has not yet been flagged as malicious by common security vendors. However, the domain is active and under investigation by threat analysts. There is no public data on the registrar or domain creation date provided, and no blocklist counts have been reported so far.

Users who have visited app.hyperliquid.global are strongly advised not to enter any login information or personal data. If credentials were submitted, immediate password changes on the official Hyperliquid platform and enabling two-factor authentication are recommended. Regular monitoring of account activity and reporting suspicious behavior to official support channels can help mitigate risks. Always verify URLs carefully and consult PhishDestroy or other threat intelligence sources for updated information before interacting with any site that mimics known brands like Hyperliquid.