hiypenlirqvid[.]cc

This domain, hiypenlirqvid.cc, is flagged as an active brand impersonation threat targeting Hyperliquid, a known entity in the cryptocurrency or financial trading sector. Registered on February 21, 2026, through NiceNIC International Group Co., Limited, the domain currently resolves to the IP address 104.21.40.75, which is associated with Cloudflare's network (AS13335). The infrastructure analysis reveals the use of Cloudflare nameservers (kirk.ns.cloudflare.com and tessa.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), indicating a deliberate attempt to leverage trusted service providers to evade detection or appear legitimate. The domain's HTTP status is 521, and the page title displays a 522 connection timeout error, suggesting either a temporary technical issue or an intentional evasion tactic to avoid automated analysis. Despite this, the domain remains active and is detected by three out of ninety-five security vendors on VirusTotal, with one security blocklist already listing it. The scam type is classified as brand impersonation, though the exact content or methodology of the phishing attempt is not yet confirmed due to the current inaccessibility of the site. Defenders should treat this domain as high-risk based on its association with Hyperliquid impersonation, Cloudflare-hosted infrastructure, and early detection by security tools. The domain's creation date and use of a content delivery network align with common phishing campaign tactics, where rapid deployment and obfuscation are prioritized. While the specific payload or deception method remains unconfirmed, the combination of brand targeting, SSL certification, and partial vendor detections warrants immediate blocking at the network or endpoint level. Monitoring for changes in HTTP status or additional detections by security vendors may provide further clarity on the domain's intent or operational status.