hyperliquid[.]fm

This domain, hyperliquid[.]fm, presents a targeted brand-impersonation threat designed to deceive users into interacting with a fraudulent trading platform. Analysis of the page title, '38.478 | HYPE/USDC | Hyperliquid,' indicates an attempt to replicate Hyperliquid’s legitimate cryptocurrency exchange interface, specifically targeting users familiar with HYPE/USDC trading pairs. The domain’s infrastructure and content are engineered to harvest login credentials, private keys, or facilitate unauthorized fund transfers under the guise of a trusted service. The inclusion of financial metrics (e.g., '38.478') further enhances the illusion of authenticity, increasing the likelihood of user engagement with malicious intent. Evidence supporting the malicious classification includes detection by 3 of 95 security vendors on VirusTotal, with the domain appearing on one security blocklist. Infrastructure analysis reveals it resolves to the IP address 185.253.212.22 and was registered on March 28, 2026, through Instra Corporation Pty Ltd. The domain has been flagged in one AlienVault OTX threat intelligence pulse and assigned a trust score of 61/100 by Gridinsoft. Technologies detected on the domain include Skolengo, MariaDB, Java, Apache Tomcat, and Amazon Web Services components (S3, CloudFront), suggesting a sophisticated backend designed to support credential harvesting or transaction manipulation. Users who visited hyperliquid[.]fm should immediately revoke any active sessions linked to the domain and reset credentials for associated accounts, particularly those tied to cryptocurrency wallets or exchanges. Monitor financial transactions for unauthorized activity and report any suspicious behavior to relevant security teams. If sensitive data was entered, assume compromise and conduct a full audit of connected systems. The domain is currently offline, but users should remain vigilant for similar impersonation attempts targeting Hyperliquid or other trading platforms.