hyipenlirquind[.]cc

Analysis of hyipenlirquind.cc shows a high‑risk brand‑impersonation campaign targeting users of the Hyperliquid platform. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to 104.21.90.96, an address owned by Cloudflare (AS13335) located in the United States. Cloudflare’s services are evident from the detected technologies, including HTTP/3 support and the authoritative nameservers paloma.ns.cloudflare.com and vasilii.ns.cloudflare.com. The site presents an HTTP 520 response and a page title that reads “hyipenlirquind.cc | 521: Web server is down,” indicating that the underlying web server is currently unavailable, a common tactic used to hide malicious payloads until a victim accesses the URL.

VirusTotal records three detections out of ninety‑five scanning engines, confirming that at least a subset of security vendors have flagged the domain as malicious. The domain appears on a single public blocklist and is actively listed by PhishDestroy, reinforcing the classification of brand impersonation. The TLS certificate is issued by Google Trust Services under the WE1 designation, which is typical for Cloudflare‑proxied sites and does not, by itself, guarantee legitimacy. Defenders should treat hyipenlirquind.cc as a confirmed malicious indicator.

Immediate actions include adding the domain to URL filtering rules, enforcing DNS sink‑hole or blocklist entries, and monitoring outbound connections to the associated IP address. Because the infrastructure relies on a shared Cloudflare edge, additional scrutiny of other domains hosted on the same IP may be warranted. Organizations that use Hyperliquid services should educate users to verify URLs against the official Hyperliquid domain and consider implementing domain‑based authentication checks. Continuous re‑evaluation is advised, as the site may become active again or change its hosting configuration.