huperliquid[.]xyz

This domain, huperliquid.xyz, is identified as a brand impersonation threat specifically targeting Hyperliquid, a known cryptocurrency platform. The domain is currently offline, but prior activity indicates malicious intent to deceive users by mimicking the legitimate Hyperliquid brand. Analysis confirms the domain was actively used for fraudulent purposes before being taken down. Infrastructure analysis reveals the domain was registered on March 22, 2026, through NameSilo, LLC, and resolved to the IP address 188.114.97.3. It is flagged by 4 of 95 security vendors on VirusTotal, indicating a moderate but notable detection rate. The domain appears on one security blocklist and was previously blocked by PhishDestroy. Detected technologies include Amazon Web Services, Cloudflare Browser Insights, Amazon S3, and Amazon CloudFront, with an SSL certificate issued by Google Trust Services. The page title was recorded as 'Loading...', a common placeholder for malicious landing pages designed to evade initial scrutiny. Given the elevated risk level and confirmed brand impersonation activity, organizations and users are advised to treat this domain as malicious. Immediate actions include blocking the domain and its associated IP address (188.114.97.3) at the network level, updating endpoint protection rules, and monitoring for any residual attempts to leverage the domain or similar infrastructure. Users who may have interacted with this domain should verify account integrity, reset credentials, and report any suspicious transactions to the legitimate Hyperliquid platform.