hypenliquld[.]com

hypenliquld.com is currently flagged as an offline brand‑impersonation infrastructure targeting users of the Hyperliquid platform. The domain was registered on 21 February 2026 through Hello Internet Corp and resolves to the Cloudflare IP 188.114.97.3, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. No TLS certificate is present, confirming the absence of HTTPS support. The authoritative name servers are sima.ns.cloudflare.com and tosana.ns.cloudflare.com. Reputation checks show a Gridinsoft trust score of 0 / 100 and the domain appears on three external blocklists.

It has been actively blocked by PhishDestroy, MetaMask, and the SEAL service. VirusTotal analysis reports that 13 of 93 scanning engines have flagged the domain as malicious, reinforcing the suspicion of hostile intent. The public blocklist status and the low trust score indicate that the infrastructure is being treated as high‑risk by multiple security vendors. Available intelligence does not include a captured page title, HTTP response body, or any observed payload, so the exact malicious content and the tactics used by the operators remain unknown.

The lack of SSL and the offline HTTP status suggest that the site may have been taken down or is being monitored for activity. Defenders should add hypenliquld.com to local deny lists, enforce DNS‑based blocking, and monitor for any resurgence of the domain or related sub‑domains hosted on the same Cloudflare IP range. Continuous re‑scanning with multi‑engine services such as VirusTotal is advised to capture any changes in detection status. Organizations that use Hyperliquid services should educate users about the possibility of credential‑stealing attempts and advise verification of URLs before credential entry.