hyperliquid[.]com-api-gateway-v1-gateway-dex[.]cloud

This domain is flagged as an elevated-risk brand impersonation threat targeting Hyperliquid, a decentralized exchange platform. Analysis indicates the infrastructure was designed to mimic legitimate Hyperliquid services, likely to deceive users into disclosing sensitive credentials or transferring assets under false pretenses. The specific threat type—brand impersonation—exploits trust in the Hyperliquid brand to facilitate fraudulent activities, including credential harvesting or unauthorized transactions. Infrastructure analysis reveals the following technical indicators: the domain was registered on October 27, 2025, through Web Commerce Communications Limited. It resolves to the IP address 188.114.97.3 and has been flagged by 2 out of 95 security vendors on VirusTotal. The Gridinsoft trust score for this domain is 0 out of 100, indicating a complete lack of credibility. The page title, 'Hyper Foundation,' further suggests an attempt to impersonate official Hyperliquid communication channels. The domain appears on one security blocklist and was subsequently taken offline, though historical records confirm its prior malicious activity. Mitigation steps for organizations and users include immediate blocking of the domain and its associated IP address (188.114.97.3) at the network perimeter. Security teams should conduct retrospective analysis to identify any prior interactions with this domain, particularly within logs or endpoint detection systems. Users who may have engaged with this domain should be advised to reset credentials for any accounts associated with Hyperliquid or related financial services. Additionally, monitoring for similar domain registrations—particularly those using subdomain spoofing techniques (e.g., 'api-gateway-v1-gateway-dex')—is recommended to preempt further impersonation attempts. Domain registrars and hosting providers should be notified of abusive infrastructure to facilitate takedown efforts.