hyperilquid[.]foundaiton[.]bond

Analysis of hyperilquid.foundaiton.bond shows a recently registered domain (created 21 February 2026) that claims to target the Hyperliquid brand. The site resolves through Cloudflare, using the nameservers mary.ns.cloudflare.com and peyton.ns.cloudflare.com and supports HTTP/3. A HTTP request returns a 404 Not Found page title, indicating that no content is presently served. VirusTotal reports two of ninety‑three scanning engines flagging the domain, suggesting malicious intent despite the lack of active payload.

The registrar listed is NiceNIC International Group Co., Limited and the domain appears on a single external blocklist; it has been actively blocked by the PhishDestroy feed. The threat classification in the intelligence is “Brand Impersonation”, confirming that the domain is being used to mislead users into believing it is associated with Hyperliquid. The current offline status limits immediate exposure, but the infrastructure choices—Cloudflare front‑end and HTTP/3 support—are typical of fast‑flux or disposable phishing infrastructure, making rapid re‑activation plausible. Defenders should continue to monitor the domain’s DNS records for changes, add the domain to local deny‑list policies, and verify that any internal URL filtering solutions ingest the blocklist entry from PhishDestroy.

Because the site presently returns a 404, there is no evidence of a phishing landing page or credential‑harvesting form, but the presence of vendor detections and the brand‑impersonation tag warrant precautionary blocking. Continuous re‑scanning via VirusTotal or similar services is recommended to capture any future payload deployment. Organizations that rely on Hyperliquid services should educate users about the misspelled “foundaiton” sub‑domain and enforce verification of official URLs.