hyperliquidbeta[.]xyz

hyperliquidbeta.xyz is flagged as a high‑risk brand‑impersonation site targeting the cryptocurrency platform Hyperliquid. The site presents a page titled "Hyperliquid Desktop App," which directly mimics the official application interface and is intended to deceive users seeking legitimate access. The domain was registered on 21 April 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED, indicating a recent creation aligned with the observed campaign timeline. Network analysis shows the domain resolves to IP address 64.29.17.1, hosted in the United States and associated with Vercel, Inc. The authoritative nameservers are ns1.vercel-dns.com and ns2.vercel-dns.com, confirming the use of Vercel’s DNS infrastructure. The web server presents an HTTPS certificate issued by Let's Encrypt (R13) and enforces HTTP Strict Transport Security, which may lend a false sense of legitimacy to unsuspecting victims. Reputation services provide corroborating evidence of malicious intent. The domain received a 0/100 trust score from Gridinsoft and was flagged by five of ninety‑five security vendors on VirusTotal. It is listed on one active security blocklist and has been blocked by the PhishDestroy sinkhole, reinforcing its classification as an impersonation scam. An HTTP GET request returns status code 200, indicating that the malicious page is actively serving content. Defenders should add hyperliquidbeta.xyz to outbound and inbound blocklists across firewalls, proxy gateways, and email gateways to prevent user interaction. Continuous monitoring of DNS queries for the Vercel nameservers and the associated IP address is advised, as the infrastructure could be leveraged for additional phishing or credential‑harvesting sites. Organizations that utilize Hyperliquid services should educate users about the authentic branding and encourage verification of URLs before entering credentials.