app[.]hyperliquid[.]xyz

The domain app.hyperliquid.xyz was registered on February 21, 2026 through Squarespace Domains II LLC and is currently active. DNS resolution points to the IPv4 address 188.114.97.3, which belongs to AS13335 and is hosted in the United States. The authoritative name servers are ns-1371.awsdns-43.org, ns-480.awsdns-60.com, ns-531.awsdns-02.net, and ns-18 (truncated). A web request returns HTTP 200 and the page title “30.860 | HYPE/USDC | Hyperliquid”, directly mimicking the legitimate Hyperliquid brand.

VirusTotal analysis shows a single security vendor flagging the domain out of 95 scanned, indicating low detection coverage. The domain appears on one public blocklist and has been explicitly blocked by PhishDestroy. Reputation scoring from Gridinsoft rates the site at 20 / 100, and the TLS certificate is issued to “Amazon / Amazon RSA 2048 M04”. Technology fingerprinting reveals the presence of Skolengo, MariaDB, Java, Apache Tomcat, and a suite of Amazon cloud services including S3 and CloudFront, alongside Google Analytics. These components are typical of a generic hosting stack rather than a targeted counterfeit of Hyperliquid’s trading interface.

While the infrastructure points to a legitimate cloud provider, the combination of a brand‑specific page title, a recent registration date, and the low trust score suggests a purposeful impersonation campaign aimed at cryptocurrency users. The limited number of detections leaves open the possibility of additional undiscovered hosting or payload components. Defenders should add app.hyperliquid.xyz to web‑filter and DNS blocklists, monitor for any CNAME or A‑record changes, and enforce strict verification of any Hyperliquid‑related communications. End‑user awareness training that highlights the mismatch between official Hyperliquid URLs and this subdomain can further reduce exposure.