hyperliquid[.]gigabrain[.]gg

hyperliquid.gigabrain.gg is an active brand‑impersonation site targeting users of the Hyperliquid platform. The domain was registered on March 28 2026 through NameCheap, Inc. and resolves to the IPv4 address 66.33.60.130, which is owned by Vercel, Inc. in the United States. The site returns HTTP 200 and presents a TLS certificate issued by Let’s Encrypt (R12), indicating standard HTTPS deployment. The page title “Gigabrain x Hyperliquid” is displayed to lure victims.

The front‑end is built with Node.js, React, Next.js and Webpack, and the hosting environment reports Vercel infrastructure with HSTS enabled. DNS is served by the four Vercel DNS nameservers (ns1‑ns4.vercel‑dns‑3.com), confirming the use of Vercel’s edge network. No additional sub‑domains or C‑NAME records were observed, suggesting a single‑point hosting model.

Threat intelligence sources show mixed detection: 1 of 95 security vendors on VirusTotal flagged the domain, and it appears on a single public blocklist. Gridinsoft assigns a trust score of 0 / 100, and PhishDestroy has already blocked the site, indicating that security communities consider the domain malicious. The low vendor detection count may reflect the short lifespan of the domain, but the presence of a brand‑impersonation page, combined with the active blocklist entry, raises the risk to a high level.

Defenders should immediately add 66.33.60.130 and hyperliquid.gigabrain.gg to network blocklists and intrusion‑prevention signatures. Email gateways should be tuned to detect references to “Gigabrain x Hyperliquid” and similar lure phrases. User‑education campaigns must warn Hyperliquid users to verify URLs and avoid unsolicited links that reference the Gigabrain collaboration. Continuous monitoring of Vercel‑hosted assets and periodic re‑scanning of the domain are advised to catch any re‑deployment or variant.