hypcriiquid[.]top

The domain hypcriiquid.top was registered on 2026-04-02 through 耐思尼克国际集团有限公司 and resolves to 172.67.134.25, a Cloudflare‑owned address located in Canada. The zone is served by the Cloudflare nameservers hope.ns.cloudflare.com and lou.ns.cloudflare.com, and the site presents a Let's Encrypt certificate (CN hypcriiquid.top, issued by E7). HTTP requests return a 521 “Web server is down” status and the page title mirrors the same message, indicating that the front‑end is currently offline but the infrastructure remains active. The domain is flagged as an impersonation of the cryptocurrency exchange Hyperliquid; the threat classification is listed as brand impersonation with a high risk rating. Intelligence sources show the domain appearing in eight AlienVault OTX pulses and being listed on two public blocklists, specifically PhishDestroy and ScamSniffer. VirusTotal scans have recorded three positive detections out of ninety‑four scanners, and Gridinsoft assigns a trust score of 0 / 100. The evidence suggests a deliberate attempt to lure victims by exploiting the Hyperliquid brand, although the active web content cannot be confirmed due to the 521 response. Defenders should add hypcriiquid.top to deny‑list rules, monitor DNS queries for the associated IP and nameservers, and treat any traffic to the domain as malicious until further analysis confirms remediation.