share-nowmedia[.]com

Analysis of the domain share-nowmedia.com indicates active participation in a high-risk brand impersonation campaign targeting Hyperliquid, a cryptocurrency platform. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and currently resolves to the IP address 188.114.97.3, hosted on Cloudflare's infrastructure (AS13335). The nameservers, coleman.ns.cloudflare.com and oaklyn.ns.cloudflare.com, further confirm Cloudflare's role in the domain's hosting and DNS management. The site employs an SSL certificate issued by Google Trust Services (WE1), a common practice among both legitimate and malicious sites leveraging Cloudflare's services. The domain is flagged by three security blocklists, including PhishDestroy, MetaMask, and SEAL, which classify it as a crypto scam.

The page title explicitly displays 'Hyperliquid,' aligning with the reported brand impersonation. At the time of analysis, the domain returns an HTTP 301 redirect status, though the destination remains unconfirmed. VirusTotal reports that 2 out of 93 security vendors have detected the domain as malicious, a modest but notable detection rate that suggests emerging awareness of the threat. Infrastructure analysis reveals no indication of compromised or bulletproof hosting; instead, the domain appears to rely on Cloudflare's standard services, which may obscure additional details about the origin server.

The registration details provided by NiceNIC do not include identifiable actor information, limiting attribution efforts. Defenders should treat this domain as an active threat, particularly in environments where Hyperliquid or cryptocurrency transactions are relevant. Blocking the domain at the DNS or network level is recommended, and security teams should monitor for related domains registered through the same registrar or utilizing similar Cloudflare-based infrastructure.