hyperliquid-box[.]xyz

hyperliquid-box.xyz was first observed on March 28, 2026 and is currently active. The domain is delegated to Cloudflare nameservers jerome.ns.cloudflare.com and natasha.ns.cloudflare.com and resolves to the IP address 172.67.169.104, which is geolocated to California, United States. The site presents a Google Trust Services / WE1 TLS certificate, indicating a legitimate‑looking HTTPS endpoint. Registration was performed through Global Domain Group LLC, and the domain appears on a single security blocklist.

Infrastructure analysis shows the hosting provider is Cloudflare, Inc., consistent with the observed nameserver configuration and IP address. The same IP address hosts multiple domains that have been cited in 22 AlienVault OTX threat‑intelligence pulses, suggesting a shared malicious infrastructure. The domain is currently listed on one public blocklist and has been flagged by PhishDestroy as a confirmed impersonation site.

Web probing returns an HTTP 403 response, which is typical for sites that restrict direct access while serving malicious content through specific pathways. VirusTotal scans have resulted in 2 out of 95 security vendors marking the domain as malicious, providing additional independent confirmation. The site explicitly impersonates the Hyperliquid brand, a classic brand‑impersonation tactic aimed at harvesting credentials or redirecting users to fraudulent financial services.

Defenders should add hyperliquid-box.xyz to network‑level deny lists and configure email gateways to reject messages containing references to this domain. Continuous monitoring of DNS queries for the domain and its associated IP address is advised to detect any lateral movement. Organizations that use Hyperliquid services should reinforce user awareness training and verify that any login URLs resolve to official Hyperliquid endpoints before credential entry.