hyperliquidfoundatlon[.]xyz

The domain hyperliquidfoundatlon.xyz is currently active and has been classified as a brand impersonation targeting Hyperliquid. It was registered on March 28, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to IP address 188.114.97.3, which belongs to Cloudflare, Inc. in Canada. DNS resolution uses the Cloudflare authoritative name servers alla.ns.cloudflare.com and keanu.ns.cloudflare.com. The site presents an HTTPS certificate issued by Google Trust Services under the WE1 designation, indicating a valid TLS chain, but HTTP requests return a 403 status code and the page title is limited to "Just a moment...". Intelligence sources show the domain appears in a single AlienVault OTX pulse and is listed on one public blocklist, with PhishDestroy already blocking it. VirusTotal analysis reports six of ninety-four security vendors flagging the domain, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. While the exact payload or credential‑stealing mechanisms have not been publicly disclosed, the combination of brand impersonation labeling, low trust scores, and vendor detections suggests a high‑risk profile. Defenders should block the domain at network perimeters, update DNS filtering policies, and monitor for any outbound connections to the associated IP. Continuous re‑evaluation is advised in case additional indicators emerge.