hyperliq[.]org

Analysis of hyperliq.org indicates a brand impersonation campaign targeting Hyperliquid, a cryptocurrency exchange platform. The domain was registered on October 14, 2025, through Atak Domain Bilgi Teknolojileri A.Ş. and is currently offline as of the latest assessment on July 24, 2026. Infrastructure analysis reveals the domain resolved to 188.114.96.3, an IP address associated with Cloudflare, Inc. (AS13335), and used Cloudflare nameservers (kristin.ns.cloudflare.com, stan.ns.cloudflare.com). No SSL certificate was detected, which is atypical for legitimate financial services but common in low-effort phishing setups.

Detection data is limited but notable: one of 95 security vendors on VirusTotal flagged the domain, and it appears on at least one security blocklist (PhishDestroy). The page title 'Nur einen Moment…' suggests a temporary holding or redirection page, though the exact content and functionality remain unconfirmed due to the domain's offline status. Gridinsoft assigned a trust score of 0/100, reinforcing suspicions of malicious intent. The scam type is classified as brand impersonation, aligning with the stated target of Hyperliquid. Defenders should treat this domain as high-risk infrastructure.

Although currently offline, the domain may resurface or be repurposed. Network-level blocking of 188.114.96.3 and monitoring for re-registration or DNS changes is recommended. Security teams should also review logs for connections to this domain or IP, particularly from users who may have interacted with it prior to takedown. Given the Cloudflare hosting, additional scrutiny of domains sharing the same nameservers or IP range may uncover related threats. No evidence of widespread detection exists, but the combination of brand impersonation, low trust scores, and blocklist presence justifies elevated alert status.