hyperliquid[.]blothecap[.]xyz

The domain hyperliquid.blothecap.xyz is currently active and has been classified as a high‑risk brand‑impersonation site targeting the cryptocurrency platform Hyperliquid. DNS resolution points to the IPv4 address 35.75.242.111, which belongs to an AWS EC2 instance in the ap‑northeast‑1 region (Japan). The host serves content over HTTPS using a valid Let’s Encrypt certificate (issuer E7) and supports HTTP/3, indicating a modern web stack. Registration data show the domain was created on 28 Mar 2026 through Squarespace Domains II LLC and is delegated to Google Cloud DNS name servers ns‑cloud‑c1.googledomains.com, ns‑cloud‑c2.googledomains.com, and ns‑cloud‑c3.googledomains.com. The only publicly available page title is “hlstate — Hyperliquid Position Scanner”, which aligns with the claimed brand target. Threat intelligence sources list the domain on one blocklist (PhishDestroy) and two of ninety‑four VirusTotal scanners have flagged it, while Gridinsoft assigns a trust score of 0 / 100. No additional content analysis is available, so the exact malicious payload or credential‑harvesting mechanisms remain unknown. Defenders should immediately block DNS resolution and HTTP traffic to hyperliquid.blothecap.xyz, add the domain to intrusion‑detection signatures, and monitor for related indicators such as the IP 35.75.242.111 and the associated Google Cloud name servers. Ongoing collection of page content and network behavior is advised to confirm the full scope of the impersonation campaign.