app-hyparliquid[.]eu[.]com

Analysis shows that app-hyparliquid.eu.com is an active domain created on February 21, 2026 and currently resolves to IP 104.21.44.181, which belongs to AS13335 Cloudflare, Inc. in the United States. The domain is secured with a Google Trust Services / WE1 SSL certificate, but the web server returns HTTP status 521 with the page title "app-hyparliquid.eu.com | 522: Connection timed out," indicating a connection timeout behind Cloudflare's edge. Infrastructure data lists four CentralNIC nameservers (ns1‑ns4.centralnic.net) and the registrar is Instra Corporation Pty Ltd. The site is classified as a brand‑impersonation campaign targeting Hyperliquid, and it appears on at least one security blocklist, with PhishDestroy already blocking it. Reputation scoring is extremely low (Gridinsoft 0/100) and three of ninety‑one VirusTotal scanners have flagged the domain. Detected technologies include Cloudflare and HTTP/3. While the exact payload or credential‑harvesting page has not been observed, the combination of brand impersonation labeling, low trust score, and active blocklist inclusion signals a high‑risk indicator. Defenders should block the domain and its associated IP at network perimeters, monitor DNS queries for the listed nameservers, and add the domain to internal threat intel feeds. Continuous re‑evaluation is advised in case the site becomes reachable or new malicious content is identified.