hyperliquib[.]co[.]com

The domain hyperliquib.co.com was registered on February 21, 2026 and is presently taken offline. Infrastructure analysis indicates that the domain resolves to the IP address 104.20.33.49, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presented the page title "Hyper Liquid - Futuristic Beverage Experience," directly referencing the target brand Hyperliquid, confirming the classification as a brand‑impersonation campaign. The TLS certificate in use is the Cloudflare TLS Issuing ECC CA 1, a standard Cloudflare‑provided certificate, offering no additional trust signals beyond the hosting provider.

The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service, indicating that at least one external threat intelligence feed recognized the malicious activity. VirusTotal records show that the domain was scanned by 93 vendors, with none currently flagging it; however, the absence of detections does not constitute evidence of safety. The current status is offline, limiting immediate exposure, but the infrastructure components—public Cloudflare IP, legitimate‑looking certificate, and brand‑related page title—are typical of phishing infrastructure that can be re‑activated.

Defenders should continue to monitor the domain for any re‑appearance, ensure that internal DNS filters block hyperliquib.co.com, and add the domain to local blocklists. Incident response teams should also correlate any inbound traffic to the IP 104.20.33.49 with known Cloudflare abuse patterns and consider augmenting detection rules with the observed page title and brand reference. Continued vigilance is advised until the threat is fully mitigated.