hyperliquid[.]club

The domain hyperliquid.club is currently active and has been classified as a high‑risk brand‑impersonation site targeting the Hyperliquid brand. Infrastructure analysis shows the domain was registered on March 28, 2026 through Dynadot Inc and is delegated to the authoritative nameservers ns1.dyna-ns.net and ns2.dyna-ns.net. DNS resolution points to the IP address 54.215.31.113, an Amazon EC2 instance located in the US West (us‑west‑1) region. The web service presents a TLS certificate issued by Let’s Encrypt (R13) and responds with an HTTP 302 redirect. Detected technologies include Apache Tomcat, Java, MariaDB, Skolengo, and Amazon services (S3, CloudFront). The page title returned by the server is "38.358 | HYPE/USDC | Hyperliquid," which aligns with the claimed brand target. Reputation data shows a Gridinsoft trust score of 0/100 and 13 of 94 VirusTotal scanners flag the domain as malicious. The domain is listed on two security blocklists, PhishDestroy and ScamSniffer. While the exact page content beyond the title has not been examined, the combination of brand‑specific title, high‑risk classification, and multiple security detections indicates a deliberate attempt to deceive users. Defenders should block hyperliquid.club at network and endpoint layers, add it to URL filtering policies, and monitor for any related traffic patterns. Continuous re‑evaluation is advised in case the site evolves or additional indicators emerge.