app-hyperliquidl[.]eu[.]com

On 25 July 2026, the domain app-hyperliquidl.eu.com was observed conducting a brand‑impersonation campaign targeting Hyperliquid. The domain was registered on 21 February 2026 through Instra Corporation Pty Ltd. and is hosted behind Cloudflare’s network (AS13335) with the IP address 172.67.171.23 located in the United States. DNS resolution uses the CentralNIC name servers ns1‑ns4.centralnic.net. The TLS certificate presented is issued by Google Trust Services under the WE1 authority, indicating a valid‑looking HTTPS endpoint.

HTTP requests to the host return status code 521, and the page title retrieved reports “522: Connection timed out”, suggesting the backend service is intentionally unavailable or misconfigured to evade content analysis. The infrastructure matches a known crypto‑scam pattern; the campaign is classified as a crypto scam and is listed on at least one security blocklist. PhishDestroy has already blocked the domain, and a single detection on VirusTotal shows that one of ninety‑three security vendors flagged the site, reinforcing the malicious intent. The Gridinsoft trust score of 0/100 further confirms the lack of legitimacy.

No additional public intelligence, such as Safe Browsing or OTX entries, is currently available for this domain. Given the active status, high risk rating, and the presence of a brand‑impersonation component, defenders should add the domain to URL filtering and web‑gateway block lists, monitor DNS queries for the associated IP and name servers, and consider sink‑holing the IP range if feasible. Continuous re‑scanning with multi‑vendor services is advised to capture any changes in the payload or hosting configuration. Organizations using Hyperliquid services should alert users to the possibility of fraudulent communications referencing this domain.