hyperliquid-v2[.]org

The domain hyperliquid-v2.org has been identified as a brand_impersonation threat targeting Hyperliquid, a decentralized exchange platform. Analysis confirms the domain was designed to mimic the legitimate Hyperliquid interface, as evidenced by its page title, which directly replicates the brand name. At the time of assessment, the domain has been taken offline, though prior activity indicates a deliberate attempt to deceive users into interacting with fraudulent infrastructure. Technical indicators reveal the domain was registered through Porkbun LLC on February 21, 2026, an unusually future-dated creation that may suggest domain generation algorithm abuse or registry manipulation. It resolved to the IP address 188.114.96.3, a Cloudflare-hosted endpoint leveraging HTTP/3 and secured by a Google Trust Services SSL certificate, a common tactic to lend legitimacy to malicious sites. Detection metrics show the domain was flagged by 1 of 95 security vendors on VirusTotal, while Gridinsoft assigned a trust score of 0 out of 100. The domain also appeared on three security blocklists and was actively blocked by multiple threat intelligence feeds, including MetaMask and SEAL. Current status indicates the domain is offline, though its infrastructure remains a potential vector for future malicious activity. Organizations and users are advised to proactively block the domain and its associated IP address within network security controls. Monitoring for newly registered domains containing 'hyperliquid' or similar variations is recommended, particularly those created through registrars with lenient verification processes. End-users should verify domain authenticity by cross-referencing official communication channels and avoiding interaction with unsolicited links or interfaces claiming to represent Hyperliquid.