hyper[.]liqiud[.]co[.]com

The domain hyper.liqiud.co.com was registered on February 21, 2026 and is presently taken offline. The site presented the page title “Hyper Liquid – Futuristic Beverage Experience,” suggesting a marketing‑oriented landing page that may be used to lure victims. The domain resolves to the IPv6 address 2606:4700:10::ac42:ae61, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States. An SSL certificate identified as WE1 is in place, indicating encrypted transport but offering no assurance of legitimacy.

The domain has been added to a single security blocklist and was blocked by the PhishDestroy service, confirming that at least one threat‑intelligence feed classified it as malicious. VirusTotal records show that the domain was scanned by 93 vendors; none of the vendors raised a detection at the time of scanning. While the lack of detections does not imply safety, it reflects that the current vendor data set has not flagged the site. No additional intelligence, such as Safe Browsing status, OTX references, or detailed registrar information, is available in the supplied data.

The primary uncertainties revolve around the exact phishing payload, the identity of the operators, and whether the domain has been reused in other campaigns. Defensive posture should include continued monitoring of the IPv6 address and associated ASN for any reactivation, updating blocklists to retain the domain entry, and applying generic phishing mitigation controls such as URL filtering and user awareness training. Organizations should treat any communications referencing “Hyper Liquid” or related beverage themes with heightened scrutiny until further verification can be performed.