governance-hyperliquid[.]xyz

The domain governance-hyperliquid.xyz was created on 15 November 2025 and is registered through Dynadot LLC. DNS resolution points to 142.251.32.100, an address owned by Google LLC (AS15169) located in the United States. The domain uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but no TLS certificate is presented, leaving the HTTP service unencrypted. The page title returned by the server is “Google”, which does not correspond to the advertised brand Hyperliquid and suggests a deceptive attempt to mislead visitors. The site is currently taken offline, yet historical scans retain evidence of malicious activity.

Gridinsoft assigns a trust score of 0 out of 100, indicating maximal suspicion. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service. VirusTotal analysis reports that eight of ninety‑five security vendors flagged the domain as malicious, reinforcing the suspicion. The intelligence classifies the campaign as a crypto‑scam that impersonates Hyperliquid, a known cryptocurrency trading platform.

Because the domain resolves to a legitimate cloud provider, attribution to the attacker’s infrastructure is limited to the choice of DNS and hosting services. Defenders should continue to deny any network traffic to 142.251.32.100 that originates from governance-hyperliquid.xyz, add the domain to local blocklists, and monitor for any resurgence of the domain or similar registrants. Additional monitoring of Dynadot‑registered domains that target Hyperliquid may reveal future variants. Until the domain is permanently retired, security tools should maintain the existing blocklist entry and treat any future resolution as high‑risk.