hyperliquid[.]gateway-authentication[.]xyz

This domain, hyperliquid.gateway-authentication.xyz, was registered on July 22, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active. DNS resolution points to the address 104.21.56.160, hosted on Cloudflare infrastructure as indicated by the authoritative nameservers kyle.ns.cloudflare.com and melinda.ns.cloudflare.com. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that at least one reputable threat‑intelligence source has identified it as malicious.

No public page title, SSL certificate details, HTTP response codes, or Safe Browsing verdicts have been published for this host, and there are no known references in open‑source threat platforms such as OTX. Because the site resolves to a Cloudflare‑managed IP, it benefits from the provider’s global edge network, which can obscure the true origin of any malicious payloads that might be delivered. The lack of additional detection signals suggests that the domain is either newly deployed or has evaded broader scanning.

Defenders should add hyperliquid.gateway-authentication.xyz to internal deny‑lists and URL filtering rules, monitor DNS queries for this name, and consider blocking traffic to its resolving IP address pending further investigation. Continuous re‑evaluation is advised, especially if the domain begins appearing in additional feed sources or exhibits active login‑capture pages. Logging of any outbound connections to the IP 104.21.56.160 will aid in correlating potential credential‑theft incidents.