app-hyperllquld[.]xyz

This domain, app-hyperllquld.xyz, is flagged as a brand impersonation threat targeting Hyperliquid, a cryptocurrency exchange platform. Infrastructure analysis reveals the domain was registered on June 22, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. The domain resolves to IP 172.67.201.25, hosted on Cloudflare's network (AS13335), a common obfuscation tactic used to conceal malicious infrastructure. Nameservers ace.ns.cloudflare.com and jessica.ns.cloudflare.com further confirm Cloudflare usage, which may hinder direct IP-based blocking. The SSL certificate, issued by Google Trust Services (WE1), provides encryption but does not validate legitimacy, as certificates are routinely issued to malicious domains.

Detection data indicates elevated risk: the domain appears on four security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL, which specialize in cryptocurrency-related threats. Gridinsoft assigns a trust score of 0/100, reflecting confirmed malicious activity. VirusTotal reports a single detection from 91 security vendors, suggesting limited but present coverage; the absence of broader detections does not imply safety. The page title, 'HYPE | Hyperliquid,' directly references the targeted brand, reinforcing the impersonation intent. As of July 24, 2026, the domain is offline, though this status may change; defenders should not assume permanent inactivity.

Defenders should treat this domain as a confirmed threat vector for Hyperliquid users. Immediate actions include blocking the domain and its resolving IP at perimeter security controls, updating endpoint protection rules, and alerting user bases to potential phishing attempts. Monitoring for re-activation or related domains (e.g., typosquatting variants) is recommended, particularly those leveraging Cloudflare or similar CDN services.