hyperliquid-decentralized-layer-1-blockchain[.]net

On 25 July 2026 analysts observed the domain hyperliquid-decentralized-layer-1-blockchain.net associated with a Crypto Scam targeting the Hyperliquid brand. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and uses the Cloudflare nameservers terry.ns.cloudflare.com and ximena.ns.cloudflare.com. DNS resolution points to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. No TLS certificate was presented; the site was reachable via HTTP only before being taken offline, and the current HTTP status is reported as offline.

VirusTotal analysis returned 7 positive detections out of 93 security vendors, indicating a moderate level of malicious classification. The domain appears on three independent blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. The page title retrieved during the brief online window reads “Hyperliquid: Decentralized Perpetual Futures Exchange | Low Fees & High Leverage,” confirming the use of Hyperliquid’s brand name in the content. The risk rating assigned is elevated, reflecting both the brand impersonation and the cryptocurrency‑focused nature of the campaign.

Uncertainty remains regarding the full payload or credential‑capture mechanisms, as the site was taken offline before a complete forensic capture could be performed, and no SSL/TLS details are available for deeper inspection. Defenders should add the domain and its resolving IP to network blocklists, monitor for additional domains registered with the same registrar or using similar naming patterns, and enforce strict outbound filtering for connections to Cloudflare‑hosted IPs that have no legitimate business justification. Continuous threat‑intel feeds should be consulted for any resurgence of this infrastructure, and users of Hyperliquid services should be reminded to verify URLs and avoid interacting with unsolicited links referencing this domain.