yhperliquid[.]com

Analysis indicates that yhperliquid.com was registered on May 06 2026 via Dynadot and is hosted on a public cloud compute instance in the US West (region us‑west‑1) at IP 54.215.31.113. The domain resolves through the authoritative nameservers ns1.dyna‑ns.net and ns2.dyna‑ns.net and returns an HTTP 301 redirect. TLS is provided by a Let’s Encrypt R12 certificate, which does not convey any brand legitimacy. The page title reported by crawlers is “Hyperliquid”, matching the declared brand target Hyperliquid, and the site has been classified as a brand‑impersonation campaign. Threat intelligence shows the domain appears on a single security blocklist, has been flagged by PhishDestroy, and a single VirusTotal vendor raised a detection. AlienVault OTX lists the domain in one pulse, and Gridinsoft assigns a trust score of 0/100. These indicators collectively confirm active malicious use. However, no publicly available samples of the payload or detailed phishing flow have been disclosed, so the exact tactics and credential‑harvesting mechanisms remain unknown. Defenders should add the domain and its IP address to blocklists, monitor DNS queries for the associated nameservers, and enforce outbound filtering for traffic to the identified cloud region. Incident response teams should treat any credential submissions to the site as compromised and advise affected users to change Hyperliquid credentials immediately. Ongoing watch for further infrastructure changes is recommended.