hyperliqhid[.]xyz

This domain hyperliqhid.xyz is currently active and was registered on 21 February 2026 through a registrar. DNS resolves to 54.215.31.113, an address owned by a major cloud provider. The site serves HTTP 301 redirects and presents a valid TLS certificate issued by a public certificate authority, indicating encrypted communications. Infrastructure fingerprints reveal the presence of a Java application server, a relational database, and object storage services typical of a cloud‑hosted environment. Observed analytics scripts suggest traffic monitoring. The page title returned by the server reads “26.884 | HYPE/USDC | Hyperliquid”, directly referencing the targeted brand Hyperliquid and a cryptocurrency pair, confirming a brand‑impersonation crypto scam. The domain is listed on a security blocklist, has been blocked by an anti‑phishing organization, and receives a trust score of zero from a commercial reputation engine. Seven of ninety‑three antivirus scanners have flagged the domain, indicating malicious intent. Nameserver records point to a dynamic DNS service. While the exact content and user‑interaction flow have not been captured, the combination of brand‑specific title, high‑risk classification, and malicious reputation suggests the site is used to lure victims into fraudulent cryptocurrency transactions. Defenders should immediately block the domain at perimeter and endpoint filters, monitor DNS queries for the associated IP and nameservers, and incorporate the indicator set into threat‑intel feeds. Ongoing observation of the hosting infrastructure is advised to detect any pivot or migration.