hyperliquid[.]org[.]cn

On July 27, 2026, investigators examined hyperliquid.org.cn, a domain created on May 02, 2026 and currently listed as active with a high risk rating. The domain resolves to the IPv4 address 111.68.12.188 and is delegated to the authoritative name servers ns1.myhostadmin.net and ns2.myhostadmin.net. WHOIS data shows registration was performed by 成都西维数码科技有限公司, a Chinese registrar. The domain is present on three independent security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL.

VirusTotal analysis returned 15 positive detections out of 91 scanned vendors, reinforcing the malicious classification. The available evidence points to a generic phishing infrastructure, though no detailed page content, SSL certificate, or HTTP response data have been published publicly. Consequently, the exact phishing lure, target brand, or credential‑stealing mechanism remains unknown. The lack of publicly disclosed page title or brand indicators limits attribution beyond the observed infrastructure.

Defenders should immediately add hyperliquid.org.cn and its resolving IP 111.68.12.188 to deny‑list rules across perimeter firewalls, DNS filtering services, and endpoint protection suites. Continuous monitoring of the associated name servers and blocklist status is advised, as changes to hosting or DNS could indicate a shift in campaign tactics. Organizations that employ email or web gateways should ensure that any traffic to this domain is dropped, and incident response teams should consider the domain a potential indicator of compromise when encountered in logs. Ongoing verification against threat‑intel feeds will help maintain up‑to‑date protection as the campaign evolves.