hiltonhype[.]com

Analysis indicates that the domain hiltonhype.com was actively serving content that referenced Hyperliquid, as evidenced by the page title "QUANTUM | Hyperliquid Local Execution". The title suggests an attempt to associate the site with Hyperliquid's trading platform, aligning with the listed scam type of a crypto scam and brand impersonation. The domain resolves to the IPv4 address 67.223.118.113, which belongs to the Namecheap, Inc. network (AS22612) located in the United States. Registration data shows the domain was created on 3 December 2025 and was registered through NameCheap, Inc., using the authoritative name servers dns1.namecheaphosting.com and dns2.namecheaphosting.com.

No TLS certificate was observed for the site, indicating that communications were unencrypted. Threat intelligence feeds have flagged the domain: two of ninety‑five VirusTotal scanners reported malicious activity, and the site is listed on at least one public security blocklist. PhishDestroy has also taken the domain offline, and the current status is reported as offline. The combination of brand impersonation, a crypto‑focused page title, and the absence of encryption suggests a deliberate attempt to lure victims into a fraudulent Hyperliquid‑related transaction.

While the precise payload or credential‑harvesting mechanism has not been disclosed, the available indicators are sufficient for defensive action. Organizations should add hiltonhype.com to web‑filter blocklists, monitor DNS queries for the associated IP address, and enforce TLS inspection policies to detect any future attempts to host similar content on the same infrastructure. Incident response teams should also correlate any internal logs that reference the domain or its IP with user activity around the reported offline date, and consider notifying the legitimate Hyperliquid brand to aid in coordinated takedown efforts.