hyperliquid[.]thunderhead[.]xyz

PhishDestroy identifies hyperliquid.thunderhead.xyz as an active brand impersonation domain targeting Hyperliquid. Current assessment remains under investigation due to limited detection coverage and legitimate infrastructure elements. This domain was flagged by 7 of 95 VirusTotal vendors as of the latest scan, indicating negligible detection at the time of analysis. Registered through NAMECHEAP INC on June 22, 2021, the domain resolves to IP 172.67.130.199 and holds an SSL certificate issued by Google Trust Services. While the infrastructure (IP and SSL) appears legitimate, the domain's recent impersonation tactics against Hyperliquid raise concerns regarding potential misuse for credential harvesting or fraudulent transactions. Given the absence of blocklist coverage and the domain's active status, PhishDestroy advises immediate blocking of hyperliquid.thunderhead.xyz and associated IP (172.67.130.199) within organizational security controls. Users should verify Hyperliquid domains via official channels only (hyperliquid.xyz). Additional monitoring is recommended due to the domain's longevity (since 2021) and potential for delayed malicious activation.