hyperliquid-reward[.]app

Analysis conducted on July 20 2026 indicates that the domain hyperliquid-reward.app was registered on the same day via NICENIC INTERNATIONAL GROUP CO., LIMITED and is presently resolving to the IP address 188.114.97.3. The authoritative name servers are listed as sandy.ns.cloudflare.com and tate.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. The domain has been added to a single security blocklist and is actively blocked by the PhishDestroy filtering service. VirusTotal reports that one out of ninety‑five scanned engines flagged the domain, providing limited but non‑trivial malicious confidence. No additional public detections, such as Safe Browsing alerts, OTX references, or SSL certificate details, have been published at the time of analysis. The lack of a recorded HTTP response code or page title means the content served by the site has not been captured in the current intelligence set. Given the classification as a generic phishing site, the domain is likely being used to harvest credentials or lure victims with deceptive reward offers. Defenders should add hyperliquid-reward.app to inbound and outbound allow‑list exclusions, enforce DNS sink‑holing for the address 188.114.97.3, and monitor Cloudflare name‑server queries for any rapid changes. Continuous re‑scanning with multiple AV engines is advisable, as the single detection may evolve. Until further threat‑intel is released, the domain remains high‑risk and should be treated as active malicious infrastructure.