app-hyperliquids[.]org

Analysis of app-hyperliquids.org confirms active brand impersonation targeting Ledger, a hardware wallet provider. The domain was registered on May 10, 2026, through Internet Domain Service BS Corp and currently resolves to 172.67.137.245, hosted on Cloudflare's network (AS13335). The site returns an HTTP 200 status and uses a Let's Encrypt SSL certificate (E8), presenting itself with the page title 'Ledger Live Setup: Wallet Configuration and Onboarding,' directly referencing Ledger's official software. Infrastructure analysis reveals Cloudflare as the primary hosting and DNS provider, with nameservers finley.ns.cloudflare.com and rachel.ns.cloudflare.com. Security vendors have flagged the domain, with 9 of 91 engines on VirusTotal detecting malicious activity. The domain appears on at least one security blocklist, and it is actively blocked by PhishDestroy. While the exact content of the site remains unanalyzed, the combination of brand-specific page title, recent registration, and security vendor detections strongly indicates a phishing operation designed to harvest Ledger wallet credentials or distribute malicious software. Defenders should treat this domain as high-risk and prioritize blocking or monitoring traffic to and from 172.67.137.245. Further investigation into associated infrastructure, such as related domains or IPs, is recommended to identify potential broader campaigns.