hyper-liquid[.]finance

The domain hyper-liquid.finance is currently active and is being used to impersonate the legitimate cryptocurrency platform Hyperliquid. The site returns a generic page title “Just a moment...” and serves a 403 HTTP response, indicating a deliberately restricted landing page designed to obscure malicious content while still establishing a trusted‑looking TLS session. Infrastructure analysis shows the domain resolves to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc., located in the United States. The domain is delegated to the Cloudflare nameservers theo.ns.cloudflare.com and kristin.ns.cloudflare.com, and the TLS certificate is issued by Google Trust Services under the WE1 root, confirming the use of a valid public‑trusted certificate. HTTP/3 is enabled, reflecting recent web protocol adoption. Threat intelligence indicates the domain was registered on February 21, 2026 through Devexpanse Ltd d/b/a Regery.com. It appears on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal reports that 1 of 95 scanned security vendors flagged the domain, and Gridinsoft assigns a trust score of 0 out of 100. AlienVault OTX lists the domain in one pulse, and the overall scam classification is identified as a cryptocurrency‑related impersonation. Defenders should add hyper-liquid.finance to network‑level block lists and DNS filtering policies, given its confirmed association with brand impersonation and a low trust score. Continuous monitoring of the IP 188.114.97.3 for anomalous traffic patterns is advised, as Cloudflare can host multiple malicious payloads behind the same address. Incident response teams should treat any credentials or wallet addresses submitted to this site as compromised and advise affected users to change authentication details and monitor blockchain activity for unauthorized transfers.