hopiurliquid[.]com

Analysis of hopiurliquid.com indicates a confirmed brand impersonation targeting Hyperliquid, with elevated risk classification due to infrastructure and detection patterns. The domain, registered on September 11, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, currently resolves to the IP address 45.134.10.34, hosted on AS400529 (Infraly, LLC) in the United States. No SSL certificate is present, and the domain returns an HTTP directory listing with the page title 'Index of /', suggesting either misconfiguration or deliberate exposure of server contents. Nameservers are set to ns1.webservercp.com and ns2.webservercp.com, a pattern observed in other low-reputation hosting environments.

Detection data from security vendors is limited but notable: one of 95 engines on VirusTotal flags the domain as malicious, and it appears on a single security blocklist, with PhishDestroy having already blocked access. Gridinsoft assigns a trust score of 0/100, reinforcing the domain's high-risk profile. The domain was taken offline prior to this assessment, though residual DNS records and historical infrastructure data remain accessible for analysis. Defenders should treat this domain as a confirmed threat vector for Hyperliquid brand abuse.

While no specific phishing kit or payload has been identified in the available data, the combination of directory listing exposure, absence of encryption, and hosting on a bulletproof-style ASN aligns with known impersonation tactics. Organizations should monitor for related domains using the same nameservers or IP range, and consider proactive blocking of 45.134.10.34 and associated CIDR blocks. Given the domain's offline status, further forensic analysis may be constrained, but historical WHOIS and passive DNS data could reveal additional linked infrastructure.