distributions-hyperliquid[.]xyz

Distributions-hyperliquid.xyz was registered on 21 February 2026 and resolves to the Cloudflare address 104.21.32.1, an IP located in the United States and announced by ASN 13335. The domain is listed with PDR Ltd. d/b/a PublicDomainRegistry.com as the registrar. VirusTotal analysis shows that six of ninety‑five scanning engines flag the site as malicious, and the domain appears on a single external blocklist. Gridinsoft assigns a trust score of zero out of one hundred, indicating an extremely low reputation.

The SSL certificate presented by the host is identified as “WE1”, and the page title returned by the server is “Hyper Foundation”, matching the claimed brand target of “foundation”. The threat is classified as wallet/seed phishing and explicitly impersonates the foundation brand. PhishDestroy has already blocked the domain, and the current operational status is offline, preventing live verification of the page content. Evidence confirms that the infrastructure relies on Cloudflare’s CDN, a common choice for fast‑flux and anonymisation.

The low trust score, combined with the modest detection rate on VirusTotal and the presence on a blocklist, suggests a targeted impersonation campaign aimed at extracting cryptocurrency wallet seeds from victims who trust the Hyper Foundation brand. Because the site is no longer reachable, dynamic analysis of the landing page cannot be performed, and the exact phishing flow remains unknown. Defenders should add the domain and its resolving IP to deny‑list rules, enforce DNS sinkholing where possible, and monitor for re‑registration or similar domains that reuse the “hyperliquid” string. Continuous scanning with multi‑engine services is recommended to capture any future re‑appearance, and security teams should educate users about unsolicited requests for wallet seeds that reference the Hyper Foundation brand.