hyperliquid[.]sex

On July 24, 2026 analysis indicates that hyperliquid.sex was registered on February 21, 2026 through Key-Systems GmbH. The domain resolves to the IP address 18.245.31.34, which is geolocated in Germany and belongs to the Amazon.com, Inc. AS16509 network. Hosting appears to be provided via Amazon CloudFront and Amazon S3, with an Apache Tomcat server running Java and a MariaDB backend. Additional components identified include Skolengo and Google Analytics. The TLS certificate is issued by Let’s Encrypt (R13), confirming that the site presented a valid HTTPS connection at the time of observation. The page title captured was "30.860 | HYPE/USDC | Hyperliquid," indicating an attempt to reference the Hyperliquid brand and the USDC trading pair.

The site is classified as a crypto scam and explicitly impersonates Hyperliquid. VirusTotal recorded four detections out of ninety‑three scanning engines, and the domain appears on one security blocklist. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. AlienVault OTX lists the domain in a single threat pulse, and PhishDestroy has blocked it. Nameservers are ns1.aftermarket.pl and ns2.aftermarket.pl. The infrastructure has been taken offline at the time of reporting.

Uncertainties remain regarding the exact content served before takedown, as only the page title is available; therefore, the presence of credential‑stealing forms or additional payloads cannot be definitively confirmed. Despite the low VirusTotal detection count, the blocklist presence, zero trust score, and targeted brand impersonation provide strong evidence of malicious intent. Defensive recommendations include adding hyperliquid.sex to DNS and proxy deny‑list rules, monitoring traffic to the associated IP 18.245.31.34 and its Amazon CloudFront edge, and employing TLS inspection to detect potential malicious payloads if the domain resurfaces.