hyperliquiid[.]xyz

This domain, hyperliquiid.xyz, is identified as a brand_impersonation threat specifically targeting Hyperliquid. As of the latest assessment, the domain has been taken offline, though prior activity indicates malicious intent through impersonation of the legitimate Hyperliquid brand infrastructure. Analysis reveals hyperliquiid.xyz was flagged by 10 of 95 security vendors on VirusTotal, indicating moderate detection coverage. The domain was registered through NameSilo, LLC on March 28, 2026, and resolved to the IP address 104.21.70.20. It appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1). AlienVault OTX records the domain in one threat intelligence pulse, further corroborating its association with malicious activity. While hyperliquiid.xyz is currently offline, the infrastructure and historical indicators suggest a deliberate attempt to deceive users by mimicking Hyperliquid. Organizations and individuals are advised to block the domain and its associated IP at the network perimeter. Security teams should review logs for connections to 104.21.70.20 and monitor for any resurgence of the domain or similar impersonation attempts. If encountered, users should report the domain to their security operations center for further investigation and potential takedown coordination.