hypenliquid[.]co[.]com

Analysis indicates that the domain hypenliquid.co.com was registered on 21 February 2026 and is presently offline. The site presented the page title "Hyper Liquid - Futuristic Beverage Experience," which does not reference the targeted brand but the domain is explicitly listed as impersonating Hyperliquid. The domain is listed on a single security blocklist and has been blocked by the PhishDestroy service. VirusTotal records show that the host was scanned by 93 antivirus and URL‑reputation vendors; none reported a detection at the time of scanning, though the absence of a detection does not imply safety.

DNS resolution points to the IP address 104.26.2.19, which belongs to Cloudflare, Inc. (AS13335) and resolves to a location in the United States. The TLS certificate presented is identified as "WE1," indicating a valid‑looking certificate that may aid in social engineering. The combination of a recent registration date, brand‑impersonation intent, a legitimate‑looking SSL certificate, and hosting on a widely used CDN suggests a low‑cost infrastructure typically employed for short‑lived phishing campaigns.

Defenders should continue to block the domain at perimeter and endpoint filters, add the observed IP address and associated ASN to deny‑list rules where appropriate, and monitor for any re‑registration attempts that reuse the same second‑level domain or similar branding in page titles. Because the site is offline, any active payloads are no longer reachable, but threat actors may reuse the same tactics against the Hyperliquid brand. Continuous threat‑intel feeds should be consulted for new indicators that reference hypenliquid.co.com or variants thereof.