app-hyperliquid-ca99[.]jvjkogjv[.]workers[.]dev

Analysis indicates that the domain app-hyperliquid-ca99.jvjkogjv.workers.dev is actively impersonating Hyperliquid, a cryptocurrency trading platform. The domain is registered through Cloudflare Workers and resolves to the IP address 172.67.162.182, hosted under Cloudflare's infrastructure in Canada. As of July 12, 2026, the domain remains operational with an HTTP status of 200 and a page title explicitly referencing Hyperliquid, USDT/USDC trading pairs, and a numerical value (0,99894), suggesting an attempt to mimic legitimate trading interfaces. Security vendors have flagged this domain, with 5 out of 91 detections on VirusTotal, and it appears on two security blocklists, including PhishDestroy and ScamSniffer. The domain employs technologies such as Cloudflare, jsDelivr, and crypto-js, which are commonly used in both legitimate and malicious infrastructure. The Gridinsoft trust score for this domain is 0/100, further indicating high-risk classification. While the exact content of the site has not been analyzed, the combination of brand impersonation, cryptocurrency-related page title, and security vendor detections strongly suggests malicious intent. Defenders should treat this domain as part of an active phishing or scam campaign targeting Hyperliquid users. Blocking the domain at the network level and monitoring for related subdomains or IP associations is recommended. The SSL certificate, issued by Let's Encrypt (serial E7), does not mitigate the risk, as malicious actors frequently use valid certificates to lend credibility to fraudulent sites. No registration date or historical patterns are available for further temporal analysis, but the domain's current activity warrants immediate attention.