hyperliquid[.]in2025[.]top

The domain hyperliquid.in2025.top was registered on March 28 2026 through Web Commerce Communications Ltd. Its authoritative name servers, ns1.azdigi.com and ns2.azdigi.com, resolve to an address block owned by AZDIGI. The site is currently reachable over HTTPS with a valid certificate issued by a public certificate authority, and it returns HTTP 200 for the default request.

Network probing shows the domain resolves to IP 45.252.248.191, which geolocates to Vietnam. The same IP is listed on a single security blocklist that is maintained by PhishDestroy. The page title presented to browsers is “hyperfoundation”, which bears no relation to the legitimate Hyperliquid brand. Automated reputation services assign the domain a trust score of zero out of one hundred, indicating a lack of historical goodwill.

Content analysis indicates that the site is crafted to impersonate Hyperliquid, a known cryptocurrency platform. The use of a brand‑consistent name fragment (“hyperliquid”) combined with an unrelated top‑level domain and a misleading page title suggests an intent to deceive users into believing the site is affiliated with the legitimate service. No malware detections have been reported on VirusTotal, but the absence of detections does not mitigate the observed brand‑impersonation risk.

Defenders should add hyperliquid.in2025.top and its resolving IP 45.252.248.191 to blocklists at perimeter and endpoint layers. Monitoring for DNS queries to the AZDIGI name servers can reveal early reconnaissance activity. Users of the genuine Hyperliquid service should be warned about the malicious site and instructed to verify the correct domain before entering credentials. Ongoing intelligence gathering is recommended to track any additional infrastructure that may be deployed by the operators.