hyperliquid[.]w3-app[.]com

The domain hyperliquid.w3-app.com was observed hosting a crypto‑related impersonation campaign targeting the brand across. The site’s HTML title was identified as “Hyperliquid”, matching the brand name used in the campaign. Registration records show the domain was created on 17 September 2025 and was registered through NiceNIC International Group Co., Limited. DNS resolution points to the Cloudflare network (AS13335) with the IP address 104.21.44.60 located in the United States. The authoritative nameservers are huxley.ns.cloudflare.com and ollie.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service.

Static analysis on VirusTotal indicates that six of ninety‑five scanning engines flagged the domain as malicious, and the domain appears on a single public blocklist, PhishDestroy, which has already listed it as a threat. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment. No TLS certificate was presented, meaning the site operated without HTTPS encryption, which is atypical for legitimate services. The host’s trust metrics, combined with the lack of SSL, suggest a low‑cost, fast‑deployment infrastructure commonly used for crypto scams.

Current network checks show the domain is offline, and the associated IP is no longer serving content. However, the infrastructure components—Cloudflare DNS, the low‑trust score, and the presence on a blocklist—remain observable and could be reused for future campaigns. Defenders should continue to block the domain and the underlying IP address at perimeter filters, monitor the associated Cloudflare nameservers for any re‑activation, and include the domain in threat‑intel feeds. Additional verification, such as requesting full HTTP response headers or a live page capture, would be required to confirm whether any residual services remain active.