hyperilquid[.]foundaiton[.]sbs

Analysis of hyperilquid.foundaiton.sbs shows a clear pattern of brand impersonation targeting the cryptocurrency platform Hyperliquid. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure, resolving to IP address 172.67.207.214 which is associated with AS13335 Cloudflare, Inc. in the United States. The site uses Cloudflare’s default nameservers alexis.ns.cloudflare.com and brianna.ns.cloudflare.com, but it does not present an SSL certificate, indicating that HTTPS is not configured. The page title observed during a brief fetch was "Нуреrliquid," a garbled variation of the legitimate brand name, reinforcing the impersonation intent.

Security telemetry indicates the domain appears on a single blocklist and is actively blocked by PhishDestroy. VirusTotal scans show that three of ninety‑three security vendors flagged the domain, providing additional corroboration of malicious intent. Current status is offline, yet the infrastructure footprints remain visible and could be re‑activated.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor Cloudflare‑associated IP ranges for any resurgence, and incorporate the domain into threat‑intel feeds. Because the site lacks TLS, any future re‑hosting would likely continue without encryption, making it easier to detect via passive DNS and HTTP monitoring. The primary uncertainty is whether the domain will be re‑launched; therefore, ongoing observation of the registration record and associated IP address is recommended.