hyperliquid[.]hk[.]cn

The domain hyperliquid.hk.cn is currently active and has been classified as a high‑risk generic phishing site. The zone was registered on 18 May 2026 and resolves to the IPv4 address 156.226.124.123, which is hosted in Hong Kong by CloudFly Net Inc. The web server presents a valid Let’s Encrypt certificate (R13) and returns HTTP 200 responses, indicating a fully operational site.

The hosted content mimics the branding of the HyperLiquid perpetual exchange, as evidenced by the page title “HyperLiqui – … | Perp DEX”. No additional branding assets have been captured, but the use of the HyperLiquid name and the “Perp DEX” suffix suggests an attempt to lure users of that platform. The server software identified is Apache HTTP Server, a common choice for such malicious pages.

Observational data show that 1 out of 95 VirusTotal scanners flagged the domain, and Gridinsoft assigned a trust score of 0 / 100. The site appears on three external blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL. AlienVault OTX references the domain in a single threat‑intel pulse, confirming its inclusion in broader reconnaissance feeds.

Defenders should add hyperliquid.hk.cn and its resolving IP 156.226.124.123 to network deny lists and monitor DNS queries for the domain. Given the active SSL certificate, TLS inspection may be required to capture payloads. Continuous re‑evaluation of the domain’s status is advised, as the short registration window and recent creation date imply a rapidly deployed campaign.