hyprliquid[.]net

The domain hyprliquid.net was registered on July 12, 2025 through Web Commerce Communications Limited and is currently taken offline. The site presented the page title "Hyperliquid l Airdrop" and employed an Airdrop Scam kit that targets wallet or seed credentials, indicating a wallet/seed phishing operation. Infrastructure analysis shows the domain resolves to IP address 91.92.242.155, which is assigned to AS202412 Omegatech LTD and geolocated in the Netherlands. The domain uses Cloudflare nameservers annalise.ns.cloudflare.com and chris.ns.cloudflare.com, but no SSL certificate was observed, leaving the site accessible only via plain HTTP.

Reputation signals are strongly negative: the domain appears on one security blocklist, is blocked by PhishDestroy, and received a Gridinsoft trust score of 0 out of 100. VirusTotal scans recorded 12 detections out of 95 security vendors, reinforcing the malicious classification. The site explicitly impersonates the "foundation" brand, as indicated in the intelligence payload.

Defenders should treat any URLs or email references to hyprliquid.net as malicious, block the domain at perimeter and DNS layers, and monitor for related indicators such as the IP 91.92.242.155 and the associated Cloudflare name servers. Because the site is offline, live content cannot be inspected, and the exact phishing landing page details remain unknown. Continuous observation of the hosting infrastructure and any re‑registration attempts is recommended, as threat actors often recycle compromised infrastructure for new campaigns.