hayperliduiq[.]cfd

This domain is flagged as a high-risk brand impersonation threat specifically targeting Hyperliquid, a decentralized perpetuals exchange. The site is designed to deceive users into believing they are interacting with the official Hyperliquid platform, potentially leading to credential theft, unauthorized fund access, or execution of malicious smart contracts. The threat type is classified as brand impersonation with secondary risks of crypto drainer activity based on observed patterns in similar domains.

Analysis indicates the domain hayperliduiq.cfd was registered on June 22, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domain registrations. It currently resolves to IP address 172.67.150.77, which is part of a cloud infrastructure provider's network often exploited for phishing campaigns. VirusTotal detection shows 2 out of 95 security vendors flagging the domain as malicious, a low but non-zero detection rate that may indicate either early-stage deployment or evasion techniques. The domain presents a valid SSL certificate issued by Google Trust Services, which enhances its appearance of legitimacy but provides no actual security assurance. No blocklist entries or trust score data were available at the time of analysis, suggesting the domain may still be under the radar of broader security monitoring systems.

Mitigation for this threat requires immediate action from both end users and security teams. Users should verify domain authenticity by cross-referencing with official Hyperliquid communication channels and never enter credentials or connect wallets to unverified sites. Security teams should implement DNS-based blocking of hayperliduiq.cfd and its resolving IP 172.67.150.77 at the network perimeter. Wallet providers and crypto platforms should add this domain to their phishing detection rulesets, particularly for any requests involving Hyperliquid branding. Organizations should monitor for any outbound connections to this domain or its IP, as this may indicate compromised credentials or ongoing phishing attempts. Given the domain's recent registration and low detection rate, security teams should also investigate other domains registered through the same registrar during this period for potential coordinated threats.