app-hyperliquid[.]site

Analysis shows that app-hyperliquid.site was registered on February 21, 2026 through a registrar associated with Spaceship, Inc. The domain resolves to IP address 103.57.221.81, a host located in Vietnam and served by nameservers launch1.spaceship.net and launch2.spaceship.net. The site delivers an HTTP 200 response without TLS, indicating the absence of encryption and making it vulnerable to interception.

The front‑end presents a page title of "32.227 | HYPE/USDC | Hyperliquid", mimicking a legitimate cryptocurrency trading interface. Underlying infrastructure includes a typical web application stack comprising a relational database, a server‑side runtime environment, and delivery via a cloud distribution network. The presence of these components, together with the lack of a valid SSL certificate, suggests a hastily assembled environment designed to host illicit content rather than a hardened production service.

Threat intelligence flags the domain as a brand‑impersonation site targeting Hyperliquid users. It has been listed on two security blocklists and is actively blocked by PhishDestroy and ScamSniffer. The combination of the brand‑specific page title, the use of a generic cryptocurrency pair in the title, and the association with known scam infrastructure supports the conclusion that the site is being used to deceive users into interacting with a fraudulent cryptocurrency service.

Defenders should add app-hyperliquid.site to URL filtering and DNS sinkhole policies, enforce blocklisting of the resolved IP address, and monitor outbound connections for attempts to reach this host. Network traffic inspection should flag any HTTP requests lacking TLS to this domain, and endpoint security solutions should be updated to recognize the associated page title pattern. Continuous monitoring of the registrar and DNS records is recommended to detect any re‑registration or migration attempts that could be employed to evade current mitigations.