claim[.]hyperliquid-foundation[.]one

The domain claim.hyperliquid-foundation.one was registered on May 05, 2026 through NameSilo, LLC and is currently flagged as a high‑risk brand‑impersonation site targeting Hyperliquid. Infrastructure analysis shows the domain resolves to the Cloudflare IP address 188.114.96.3, which is geolocated to Canada and is served by Cloudflare’s network (simone.ns.cloudflare.com, anirban.ns.cloudflare.com). The site presents a TLS certificate issued by Let’s Encrypt (E8) and returns HTTP 403 status, with the only observable page title reading “Just a moment…”. Security telemetry indicates the domain appears on a single blocklist, holds a Gridinsoft trust score of 0/100, and is blocked by PhishDestroy. VirusTotal records show 1 of 91 security vendors flagged the domain, suggesting at least one detection of malicious activity. The listed scam type is “Crypto Drainer,” implying attempts to illicitly capture cryptocurrency assets. Because the HTTP response is blocked, the full payload cannot be confirmed, and the exact phishing mechanics remain uncertain. Defenders should proactively block the domain and its associated IP, monitor DNS queries for the Cloudflare nameservers, and incorporate the indicator set into threat‑intel feeds. Ongoing observation of any changes to the certificate, response codes, or additional vendor detections is recommended to assess evolving risk.