hyper-liquid[.]to

Analysis of hyper-liquid.to indicates a high-risk crypto scam domain impersonating the Across protocol, currently offline as of July 23, 2026. The domain was registered on October 20, 2025, through the Government of the Kingdom of Tonga and resolves to IP address 91.92.243.31, hosted on AS202412 (Omegatech LTD) in the Netherlands. Infrastructure analysis reveals the use of DNSPod nameservers (a.dnspod.com, b.dnspod.com, c.dnspod.com), a common choice for fraudulent domains due to lenient abuse policies. The SSL certificate is issued by Let's Encrypt, a legitimate provider often exploited by threat actors to lend false credibility.

The page title, 'Hyperliquid: L1 Perpetuals DEX & HYPE Token,' suggests an attempt to mimic cryptocurrency trading platforms, aligning with the 'Crypto Scam' classification in available threat intelligence. Sixteen of 93 security vendors on VirusTotal flagged this domain, and it appears on four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. AlienVault OTX records the domain in 16 threat intelligence pulses, further confirming its malicious classification. Gridinsoft assigns a trust score of 0/100, reinforcing the high-risk assessment.

While the domain is currently offline, defenders should treat it as a confirmed threat. Organizations using Across or related DeFi protocols should block this domain at the DNS and firewall levels, monitor for related IOCs (e.g., the resolving IP and nameservers), and alert users to potential impersonation attempts. The exact content of the site remains unanalyzed, but the available evidence strongly supports its classification as a crypto scam targeting Across users.