hyperliqnid[.]co[.]com

On 24 July 2026, analysis of the domain hyperliqnid.co.com identified it as a brand‑impersonation infrastructure targeting the Hyperliquid brand. The domain was registered on 21 February 2026 and presently resolves to the IP address 172.66.157.208, which belongs to AS13335 operated by Cloudflare, Inc., geolocated in the United States. The site presented the page title “Hyper Liquid – Futuristic Beverage Experience”, a title that does not correspond to the legitimate Hyperliquid offering and therefore supports the classification as brand impersonation. The TLS certificate presented is identified as “WE1”, indicating a valid‑looking SSL deployment that may be used to lend credibility to the page.

The domain is listed on a single security blocklist and has been flagged by the PhishDestroy service, confirming that at least one external sinkhole has taken action against it. VirusTotal has recorded scans from 93 antivirus and URL‑reputation engines; none of the engines currently label the domain as malicious, a result that should not be interpreted as a safety assurance given the limited detection coverage and the offline status of the site. The domain’s current HTTP response is offline, preventing live content inspection; consequently, the precise page markup, credential‑capture mechanisms, or redirect behavior remain unknown. The lack of additional blocklist listings or broader detection may reflect the recent creation date rather than an absence of malicious intent.

Defensive operators should continue to monitor the IP address 172.66.157.208 for any future activity, enforce blocking of the domain at perimeter and DNS filtering layers, and consider adding the domain to internal blocklists. Given the association with the Hyperliquid brand, security teams should alert users of potential social‑engineering attempts that reference Hyperliquid services, even if the site is presently inactive.