events-hyperliquid[.]xyz

events-hyperliquid.xyz was registered through NameSilo on 2025-08-04 and points to the IPv4 address 38.45.18.201, which is announced by AS174 belonging to Cogent Communications and geolocated in the Netherlands. The domain hosts a single nameserver and does not present an SSL certificate, returning a generic HTTP directory listing whose page title is “Index of /”. Threat intelligence categorizes the site as a crypto‑scam that impersonates the Hyperliquid brand. VirusTotal has recorded detections from three of ninety‑five scanning engines, and the domain is listed on one public blocklist.

Independent phishing‑remediation service PhishDestroy also reports the domain as blocked. The Gridinsoft trust score is 0 out of 100, indicating a lack of reputation. As of the report date the site has been taken offline, but the underlying infrastructure remains observable. Analysts should continue to block traffic to 38.45.18.201 at the network perimeter and add the domain to URL filtering policies that target brand‑impersonation and crypto‑scam indicators.

Monitoring of newly registered domains that share the “hyperliquid” keyword or that resolve to the same ASN is recommended, as adversaries frequently reuse hosting assets. Further investigation of the hosting provider’s IP range may reveal additional malicious actors. Defenders are advised to update endpoint and email security solutions with the observed indicator set to reduce exposure to similar campaigns.