app[.]hyperliquidevm[.]xyz

Analysis indicates that the domain app.hyperliquidevm.xyz remains active as of the report date, August 04, 2026, and is currently blocked by the PhishDestroy mitigation service. The zone is hosted on four NS1 nameservers (dns1.p08.nsone.net through dns4.p08.nsone.net), a configuration commonly observed for disposable phishing infrastructure. Registration data shows the domain was created on July 22, 2026 through Dynadot Inc, suggesting a short‑lived lifecycle typical of malicious campaigns. DNS resolution points to the single IPv4 address 63.176.8.218, which can be used by defenders to apply network‑level deny rules.

VirusTotal has recorded two positive detections out of ninety‑one scanned scanners, confirming that at least a pair of security engines have identified malicious behavior associated with the domain. Additionally, the domain appears on one external blocklist, reinforcing the consensus that it is being treated as hostile by community‑driven feeds. No public SSL certificate details, HTTP response codes, page title, or Safe Browsing verdicts are available in the current intelligence set, leaving the exact payload and lure mechanisms unverified.

Given the confirmed hosting, registration, and detection signals, security teams should treat app.hyperliquidevm.xyz as a high‑risk phishing host. Recommended actions include adding the domain and its resolving IP to DNS and firewall blocklists, monitoring DNS queries for similar NS1 name server patterns, and incorporating the domain into email gateway and web proxy content filters. Continuous re‑evaluation is advised as further telemetry, such as payload samples or victim reports, may surface additional indicators of compromise.