hyeprliquid[.]co[.]com

Analysis indicates that the domain hyeprliquid.co.com is actively engaged in brand impersonation targeting Hyperliquid, a cryptocurrency exchange platform. Registered on February 21, 2026, through Moniker Online Services LLC, the domain currently resolves to the IP address 172.67.169.97, hosted on Cloudflare's infrastructure (AS13335). The site returns an HTTP 302 redirect status, and its page title displays 'Account Suspended,' a common tactic used to create urgency and deceive users into interacting with fraudulent content. The domain is protected by an SSL certificate issued by Google Trust Services (WE1), which may lend an appearance of legitimacy to unsuspecting visitors. Infrastructure analysis reveals the use of Cloudflare and Cloudflare Browser Insights, technologies often employed to obfuscate the true origin of malicious sites and evade detection. The domain's nameservers (ns1.nic.co.com, ns2.nic.co.com, ns3.nic.co.com, ns4.nic.co.com) are consistent with the co.com subdomain registry, which has been historically associated with phishing and scam operations. As of July 12, 2026, the domain appears on one security blocklist, specifically PhishDestroy, and is flagged by one of 93 security vendors on VirusTotal. The Gridinsoft trust score for this domain is 0/100, further indicating its malicious nature. Defenders should note that the domain remains active and continues to pose a high risk to users. Organizations are advised to block the domain at the DNS or network level, monitor for related subdomains or redirects, and alert users to the impersonation campaign. Given the use of Cloudflare, traditional IP-based blocking may be less effective, and additional measures such as URL filtering or endpoint protection rules should be considered. The exact content and functionality of the site have not yet been analyzed, but the available evidence strongly supports its classification as a brand impersonation threat.