hypcriiquid[.]icu

The domain hypcriiquid.icu was registered on March 23, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the Cloudflare IP address 104.21.25.118, which is geolocated to Canada. The domain is currently taken offline, but historical DNS resolution indicates it was active on Cloudflare’s network. The authoritative name servers are ara.ns.cloudflare.com and nicolas.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure.

VirusTotal analysis shows that six of ninety‑four security vendors flagged the domain, indicating a moderate level of detection across scanning engines. The domain appears on three external security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the consensus that it is being used for malicious purposes. The primary threat vector is brand impersonation targeting Hyperliquid, as indicated by the intelligence tag and the declared impersonated brand.

No public page title or SSL certificate details are available, and no additional content has been captured, leaving the exact phishing landing page unknown. Defenders should continue to block hypcriiquid.icu at the DNS and network layers, monitor the associated Cloudflare IP for any re‑activation, and add the domain to internal threat‑intel feeds. Ongoing observation of related Cloudflare‑hosted domains and the registrar’s recent activity may help identify future campaigns that reuse similar naming patterns or infrastructure.